CVE-2026-86746

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0

Description An authorization bypass exists in Livewire components that enforce authorization only at the route level rather than within component lifecycle methods. An authenticated attacker can replay signed component snapshots via the 'POST /livewire/update' endpoint to invoke protected methods. This allows for privilege escalation, enabling the creation of OAuth clients, minting of personal access tokens, and access to sensitive administrative data.

Recommendations Update Snipe-IT to version 8.7.0 or later.