CVE-2026-86754 Overview
CVE-2026-86754 is an authorization bypass vulnerability in Snipe-IT versions before 8.7.0. The application fails to properly gate Laravel Passport's OAuth client management routes. Any authenticated user can register OAuth clients with attacker-controlled redirect URIs. Attackers then trick administrators into approving consent screens and exchange authorization codes for bearer tokens. These tokens inherit full administrative API permissions and remain valid for up to 40 years. The vulnerability is classified under [CWE-863: Incorrect Authorization].
Critical Impact
A low-privileged authenticated user can escalate to full administrative API access through OAuth client abuse, obtaining long-lived bearer tokens with complete asset management control.
Affected Products
- Snipe-IT IT asset management platform versions prior to 8.7.0
- Deployments using Laravel Passport for OAuth 2.0 authorization
- Any Snipe-IT instance permitting non-administrative user authentication
Discovery Timeline
- 2026-09-09 - CVE-2026-86754 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-86754
Vulnerability Analysis
Snipe-IT integrates Laravel Passport to issue OAuth 2.0 tokens for its API. Passport exposes routes for creating, editing, and managing OAuth clients. In releases before 8.7.0, Snipe-IT does not restrict these client management endpoints to administrators. Any authenticated user, including read-only accounts, can register a new OAuth client and set a redirect URI they control.
Once a client exists, the attacker crafts an authorization request pointing at an administrator's browser session. When the administrator approves the consent screen, Laravel Passport redirects an authorization code to the attacker's URI. The attacker exchanges that code for a bearer token that assumes the administrator's API scope. Snipe-IT does not down-scope tokens, so the resulting credential grants full administrative access to asset, user, and license data.
Root Cause
The root cause is missing authorization middleware on Laravel Passport's client management routes. Snipe-IT registered Passport's default /oauth/clients and related endpoints without wrapping them in an administrative gate. The application relies solely on authentication, violating the principle of least privilege for a sensitive administrative interface.
Attack Vector
Exploitation requires network access to the Snipe-IT web interface, a valid low-privileged account, and a successful social engineering step against an administrator. The attacker submits a POST request to register an OAuth client with a redirect URI they operate. They then send the administrator a crafted authorization URL, often disguised as a legitimate integration request. Administrator approval results in an authorization code delivered to the attacker's endpoint. A back-channel token exchange produces a bearer token valid for up to 40 years, providing persistent API control without repeated interaction.
Detection Methods for CVE-2026-86754
Indicators of Compromise
- New records in the oauth_clients table created by non-administrator user IDs.
- OAuth client entries with redirect URIs pointing to external or unfamiliar domains.
- Successful POST /oauth/clients requests originating from standard user sessions in web server logs.
- Long-lived bearer tokens issued shortly after suspicious client registration events.
Detection Strategies
- Audit the Snipe-IT database for OAuth clients whose user_id does not belong to an administrator role.
- Review Laravel logs for /oauth/authorize and /oauth/token activity correlated with administrator sessions.
- Alert on API calls executed with tokens tied to clients registered by non-administrator accounts.
Monitoring Recommendations
- Forward Snipe-IT application and web server logs to a centralized analytics platform for retention and correlation.
- Monitor for privilege-sensitive API calls, such as user creation and role modification, performed via OAuth bearer tokens.
- Baseline normal OAuth client counts and alert on unexpected increases.
How to Mitigate CVE-2026-86754
Immediate Actions Required
- Upgrade Snipe-IT to version 8.7.0 or later, which enforces administrative authorization on OAuth client routes.
- Enumerate all existing OAuth clients and revoke any that were not created by an authorized administrator.
- Revoke outstanding bearer tokens issued by suspicious clients to invalidate any adversary persistence.
- Rotate administrator credentials and review recent asset, user, and license changes for tampering.
Patch Information
The fix is available in Snipe-IT 8.7.0. Refer to the GitHub Security Advisory GHSA-gq7g-hxjg-8j27 and the VulnCheck advisory for release details and remediation guidance.
Workarounds
- If upgrading immediately is not feasible, restrict access to /oauth/clients and related Passport endpoints at the reverse proxy or web application firewall layer.
- Limit Snipe-IT authentication to trusted administrator accounts until the patch is applied.
- Educate administrators to reject unexpected OAuth consent prompts and validate integration requests out of band.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
