CVE-2026-86755

Name of the Vulnerable Software and Affected Versions Snipe-IT versions 4.2.0 through 8.6.3

Description Laravel Passport's auto-registered personal-access-token routes (GET, POST, DELETE '/oauth/personal-access-tokens*') are exposed using only 'web' and 'auth:web' middleware. This bypasses the self.api permission gate that is normally enforced on other token endpoints such as '/account/api' and '/api/v1/account/personal-access-tokens'. Consequently, any user with a valid web session and a valid CSRF token can send a POST request to '/oauth/personal-access-tokens' to generate a long-lived bearer token for their own account, even if an administrator has explicitly denied the self.api permission. While the resulting token remains subject to existing authorization policies and does not grant higher privileges, it bypasses administrative controls designed to prevent API or scripted access for specific users.

Recommendations Update to version 8.7.0 or later.