Authorization Bypass Vulnerability in Snipe-IT by Grokability

CVE-2026-86746

What is CVE-2026-86746?

Snipe-IT, prior to version 8.7.0, exhibits an authorization bypass weakness in its Livewire components. This vulnerability occurs due to insufficient authorization checks within component lifecycle methods, which rely solely on route-level authorization. An authenticated attacker can exploit this flaw to replay signed component snapshots through the POST /livewire/update endpoint, allowing unauthorized access to sensitive methods. This includes the ability to create OAuth clients, generate personal access tokens, and view confidential administrative information.

References