Permission Bypass in Snipe-IT Affecting Versions Up to 8.6.3

CVE-2026-86755

What is CVE-2026-86755?

Versions of Snipe-IT from 4.2.0 through 8.6.3 exhibit a significant vulnerability that allows users with active web sessions to exploit OAuth's personal-access-token routes without proper permission checks. This flaw permits such users to mint long-lived bearer tokens, circumventing the administrative controls intended to regulate access to personal account tokens. Despite the tokens being subjected to endpoint-specific authorization, this breach undermines the enforced permission settings, specifically the self.api permission gate employed by Snipe-IT for its own API endpoints. Snipe-IT addressed this vulnerability in version 8.7.0 by introducing improved middleware checks.

References