Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-86755

Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuth

CVSS 4.0 5.3 MEDIUMCVSS 3.1 5.4 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-86755

Published

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes (GET, POST, DELETE /oauth/personal-access-tokens*) with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints (/account/api and /api/v1/account/personal-access-tokens). Any user with a valid web session and the corresponding CSRF token can POST to /oauth/personal-access-tokens and mint a long-lived bearer token for their own account, even when an administrator has denied the self.api permission. The issued token is still subject to existing per-endpoint authorization policies, so this is not a privilege escalation; it defeats the administrative control intended to block API/scripted access at the user's own permission level. Fixed in 8.7.0 (commit 3f74b8c), which registers overriding routes wrapped in the can:self.api middleware.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-86755

Published

snipe-it

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "grokability",
                    "product": "snipe-it",
                    "defaultStatus": "unaffected",
                    "versions": [
                        {
                            "version": "4.2.0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThanOrEqual": "8.7.2"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON