CVE-2026-86746: Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replay
Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within component lifecycle methods. Attackers with a valid authenticated session can replay signed component snapshots via POST /livewire/update to invoke protected methods and escalate privileges, including creating OAuth clients, minting personal access tokens, and accessing sensitive admin data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Snipe-ITto a version that resolves this vulnerability.Fixed in 8.7.0 - Compensating control
Until you upgrade to Snipe-IT 8.7.0, restrict access to the Livewire update endpoint POST /livewire/update (e.g., via firewall/WAF/ACL) to reduce the ability of authenticated attackers to replay signed component snapshots.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a valid authenticated Snipe-IT session. The vector is network-accessible, but exploitation also requires user interaction and has high attack complexity.
Which deployments are affected?
Snipe-IT versions before 8.7.0 are affected. The available information does not identify any configuration prerequisite or state that a default deployment is exempt.
What actions could a successful attacker perform?
A successful replay of signed Livewire component snapshots can invoke protected methods. Documented impacts include privilege escalation, creating OAuth clients, minting personal access tokens, and accessing sensitive administrative data.
How can this be mitigated if an upgrade cannot be performed immediately?
No interim mitigation is provided in the available data. Because exploitation requires an authenticated session, limiting access to trusted authenticated users may reduce exposure, but this is not stated as a complete fix.