CVE-2026-86755

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes (GET, POST, DELETE /oauth/personal-access-tokens*) with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints (/account/api and /api/v1/account/personal-access-tokens). Any user with a valid web session and the corresponding CSRF token can POST to /oauth/personal-access-tokens and mint a long-lived bearer token for their own account, even when an administrator has denied the self.api permission. The issued token is still subject to existing per-endpoint authorization policies, so this is not a privilege escalation; it defeats the administrative control intended to block API/scripted access at the user's own permission level. Fixed in 8.7.0 (commit 3f74b8c), which registers overriding routes wrapped in the can:self.api middleware.

• CWE-863

• https://github.com/grokability/snipe-it/security/advisories/GHSA-76pf-qf59-ff3q
• https://www.vulncheck.com/advisories/snipe-it-4.2.0-through-8.6.3-permission-bypass-via-oauth

Published

Sep 9, 2026

Last Modified

Sep 9, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86749Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the…6.3
• CVE-2026-86750Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate …7.7
• CVE-2026-86751Snipe-IT before 8.7.0 fails to properly sanitize markdown im…8.5
• CVE-2026-86752snipe-it versions before 8.7.0 fail to enforce per-instance …5.4
• CVE-2026-86753snipe-it versions before 8.7.0 fail to validate the requesta…4.3
• CVE-2026-86754Snipe-IT before 8.7.0 fails to properly gate Laravel Passpor…7.3
• CVE-2026-86756Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulne…6.1
• CVE-2026-86757Snipe-IT before 8.7.0 fails to properly gate access to encry…6.5
• CVE-2026-86758Snipe-IT before 8.7.0 fails to properly enforce the viewKeys…6.5
• CVE-2026-86759Snipe-IT versions before 8.7.0 fail to authorize the POST /h…7.1
• CVE-2026-8676An attacker is able to downgrade the security of a Bluetooth…8.8
• CVE-2026-86760Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) conta…5.4