CVE-2026-86746 Overview
CVE-2026-86746 is an authorization bypass vulnerability in Snipe-IT versions before 8.7.0. The flaw resides in Livewire components that enforce authorization only at the route level, not within component lifecycle methods. Authenticated attackers can replay signed component snapshots through POST /livewire/update to invoke protected methods reserved for higher-privileged users. Successful exploitation enables privilege escalation, creation of OAuth clients, minting of personal access tokens, and access to sensitive administrative data. The vulnerability is tracked under [CWE-269: Improper Privilege Management].
Critical Impact
Authenticated low-privileged users can escalate to administrative access, mint API tokens, and exfiltrate sensitive asset management data.
Affected Products
- Snipe-IT versions prior to 8.7.0
- Snipe-IT deployments exposing Livewire endpoints to authenticated users
- Instances relying on route-level authorization for Livewire components
Discovery Timeline
- 2026-09-09 - CVE-2026-86746 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-86746
Vulnerability Analysis
Snipe-IT is an open-source IT asset management platform that adopted Livewire for reactive server-rendered components. Livewire serializes component state into signed snapshots that clients send back with each interaction. When authorization is enforced only at the route boundary, any authenticated user reaching the /livewire/update endpoint can dispatch actions against components they should not access.
Attackers exploit this gap by capturing or crafting a signed snapshot representing a privileged component. They then replay it against the shared Livewire endpoint to invoke methods that were never intended for their role. Because component lifecycle hooks such as mount, hydrate, and action methods do not re-check policies, the request executes with the target component's logic under the attacker's session.
The impact chain includes creating OAuth clients, generating personal access tokens for persistent API access, and reading administrator-scoped records. This effectively converts a low-privileged session into full administrative reach over the asset inventory.
Root Cause
The root cause is missing authorization inside Livewire component lifecycle and action methods. Route middleware confirms authentication and coarse role checks, but component methods trust the deserialized snapshot without re-validating whether the current user may execute them.
Attack Vector
Exploitation requires an authenticated session and user interaction with a crafted or replayed snapshot. The attacker submits a POST request to /livewire/update containing a valid signed snapshot and method invocation payload targeting a privileged component. See the GitHub Security Advisory and the VulnCheck Advisory on Snipe-IT for full technical details.
Detection Methods for CVE-2026-86746
Indicators of Compromise
- Unexpected OAuth client creation events in the Snipe-IT oauth_clients table.
- New personal access tokens issued to non-administrative user accounts.
- Repeated POST /livewire/update requests from a single session targeting multiple distinct component identifiers.
- Administrative record reads or exports originating from accounts without admin roles.
Detection Strategies
- Correlate Livewire update requests with the acting user's role and flag invocations against components outside their permission scope.
- Baseline normal Livewire component usage per role and alert on deviations, especially calls to user, permission, or OAuth components.
- Monitor application logs for authorization failures immediately followed by successful privileged actions from the same session.
Monitoring Recommendations
- Enable verbose audit logging in Snipe-IT for user, role, OAuth client, and API token operations.
- Forward web server and application logs to a centralized analytics platform for retention and query.
- Alert on creation of OAuth clients or personal access tokens outside of change-managed windows.
How to Mitigate CVE-2026-86746
Immediate Actions Required
- Upgrade Snipe-IT to version 8.7.0 or later without delay.
- Audit existing OAuth clients and personal access tokens, revoking any that cannot be attributed to legitimate administrators.
- Review recent administrative actions and user role changes for signs of prior exploitation.
- Restrict access to the Snipe-IT application to trusted networks where feasible.
Patch Information
The issue is fixed in Snipe-IT 8.7.0. Upgrade instructions and the security advisory are available at the GitHub Security Advisory. The patch enforces authorization within Livewire component lifecycle and action methods rather than relying solely on route middleware.
Workarounds
- If immediate patching is not possible, disable or restrict access to Livewire-driven administrative components at the reverse proxy layer.
- Reduce the number of authenticated users with access to the application until the upgrade is completed.
- Rotate all OAuth client secrets and personal access tokens after upgrading to invalidate any tokens minted through prior abuse.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.