CVE-2026-86754

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0

Description Insufficient access control on Laravel Passport OAuth client management routes allows any authenticated user to register OAuth clients using redirect URIs controlled by an attacker. This can lead to a scenario where administrators are deceived into approving consent screens, enabling the exchange of authorization codes for bearer tokens. These tokens can inherit full administrative API permissions with a validity period of up to 40 years.

Recommendations Update to version 8.7.0 or later.