Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes (GET, POST, DELETE /oauth/personal-access-tokens*) with only 'web' and 'auth:web' middleware, lacking the self.api permission gate enforced on other token endpoints. This allows users with valid web sessions and CSRF tokens to POST to /oauth/personal-access-tokens and mint long-lived bearer tokens for their own accounts, even if administrators have denied self.api permission. While the issued tokens remain subject to existing endpoint authorization policies, this bypass defeats administrative controls intended to block API/scripted access at the user's permission level. The vulnerability is fixed in version 8.7.0 by registering overriding routes wrapped in the can:self.api middleware.

Users can bypass administrative restrictions that deny API access by minting personal access tokens for their own accounts, potentially enabling scripted or API interactions that administrators intended to block. There is no privilege escalation, and issued tokens are still limited by existing authorization policies.

Upgrade to Snipe-IT version 8.7.0 or later, where the issue is fixed by adding the can:self.api middleware to the affected routes. Patch status is not explicitly stated beyond this fix version, so users should verify the upgrade. Until upgrade, administrators should be aware that API access restrictions can be bypassed by users with valid web sessions and CSRF tokens.