CVE-2026-86755: Snipe-IT Auth Bypass Vulnerability

CVE-2026-86755 Overview

CVE-2026-86755 is an authorization bypass vulnerability in Snipe-IT, an open-source IT asset management platform. Versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes without the self.api permission gate that Snipe-IT enforces on its own token endpoints. Any authenticated user with a valid web session and CSRF token can mint a long-lived bearer token for their own account, even when an administrator has explicitly denied the self.api permission. The issue is tracked as CWE-863: Incorrect Authorization.

Critical Impact
Authenticated users bypass administrative controls intended to block API and scripted access, minting bearer tokens at their own permission level.

Affected Products

Snipe-IT versions 4.2.0 through 8.6.3
Laravel Passport auto-registered /oauth/personal-access-tokens* routes
Fixed in Snipe-IT 8.7.0 (commit 3f74b8c)

Discovery Timeline

2026-09-09 - CVE-2026-86755 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86755

Vulnerability Analysis

Snipe-IT enforces a self.api permission on its own personal-access-token endpoints at /account/api and /api/v1/account/personal-access-tokens. Administrators use this permission to prevent specific users from creating API tokens or performing scripted actions against the platform.

Laravel Passport, however, auto-registers its own set of personal-access-token routes at /oauth/personal-access-tokens* (GET, POST, DELETE). In affected versions, these routes are wrapped only in the web and auth:web middleware, with no can:self.api gate. The result is a parallel token-issuance path that ignores the administrative control.

Any user holding a valid web session and CSRF token can POST to /oauth/personal-access-tokens and receive a long-lived bearer token bound to their account. Issued tokens remain subject to per-endpoint authorization policies, so this is not a privilege escalation. It defeats the administrative boundary intended to block API access at the user's existing permission level.

Root Cause

The root cause is a missing authorization check on framework-provided routes. Snipe-IT added can:self.api middleware to its custom token endpoints but did not override or gate the routes that Laravel Passport registers automatically through its service provider. Two functionally equivalent endpoints exist with divergent authorization enforcement.

Attack Vector

Exploitation requires network access to the Snipe-IT web interface and a valid authenticated session for a low-privileged user. The attacker submits a POST request to /oauth/personal-access-tokens with the session cookie and CSRF token from any authenticated page. The server responds with a bearer token that can then be used for API access outside the browser session, bypassing the administrator's self.api denial.

See the GitHub Security Advisory GHSA-76pf-qf59-ff3q and the VulnCheck Advisory on Snipe-IT for technical details.

Detection Methods for CVE-2026-86755

Indicators of Compromise

POST requests to /oauth/personal-access-tokens from users whose accounts have the self.api permission denied.
Unexpected personal-access-token records in the oauth_personal_access_clients and oauth_access_tokens database tables tied to restricted accounts.
Bearer-token API calls originating from IP addresses or user agents that differ from a user's normal browser session.

Detection Strategies

Enable Laravel request logging and alert on any HTTP request to /oauth/personal-access-tokens* on Snipe-IT versions prior to 8.7.0.
Correlate token creation events with the user's self.api permission state to flag tokens minted despite denial.
Review web-server access logs for POST requests to Passport endpoints outside standard administrative workflows.

Monitoring Recommendations

Baseline the volume of /oauth/personal-access-tokens requests and alert on deviations after upgrade.
Audit the oauth_access_tokens table on a schedule and reconcile issued tokens against approved users.
Forward Snipe-IT and reverse-proxy logs to a centralized analytics platform for retention and query.

How to Mitigate CVE-2026-86755

Immediate Actions Required

Upgrade Snipe-IT to version 8.7.0 or later, which registers overriding routes wrapped in the can:self.api middleware.
Revoke existing personal-access-tokens for users whose accounts should not have API access.
Audit user permissions and confirm the self.api permission reflects intended access boundaries.

Patch Information

The fix is included in Snipe-IT 8.7.0, delivered in commit 3f74b8c. The patch registers overriding routes for the Laravel Passport personal-access-token endpoints and wraps them in the can:self.api middleware, aligning enforcement with the existing Snipe-IT token endpoints. Refer to the GitHub Security Advisory GHSA-76pf-qf59-ff3q for full patch details.

Workarounds

Block or restrict access to /oauth/personal-access-tokens* at the reverse proxy or web application firewall until the upgrade is applied.
Add a custom middleware override in the application's route configuration to enforce can:self.api on the Passport routes.
Restrict Snipe-IT web access to trusted networks or authenticated administrators only while planning the upgrade.

bash

# Example nginx location block to deny access to the vulnerable routes
location ~ ^/oauth/personal-access-tokens {
    deny all;
    return 403;
}