CVE-2026-86746 describes an authorization bypass vulnerability in Snipe-IT versions prior to 8.7.0. The vulnerability exists in Livewire components where authorization checks are insufficiently applied, being enforced only at the route level rather than within component lifecycle methods. Attackers with valid authenticated sessions can exploit this by replaying signed component snapshots through POST /livewire/update requests, enabling them to invoke protected methods improperly. This results in privilege escalation capabilities such as creating OAuth clients, generating personal access tokens, and accessing sensitive admin information.

An attacker with a valid authenticated session can bypass intended authorization controls, escalate privileges, and perform sensitive administrative actions. This includes creating OAuth clients and personal access tokens, which could lead to further unauthorized access and control over the system. The vulnerability compromises the integrity and confidentiality of administrative functions and data within Snipe-IT.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated sessions and monitor for suspicious POST /livewire/update requests. Avoid using vulnerable versions and consider upgrading to version 8.7.0 or later once confirmed patched by the vendor.