CVE-2026-86746EPSS p19.8%

CVE-2026-86746CVE-2026-86746

snipeitapp / snipe-it

Description

Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within component lifecycle methods. Attackers with a valid authenticated session can replay signed component snapshots via POST /livewire/update to invoke protected methods and escalate privileges, including creating OAuth clients, minting personal access tokens, and accessing sensitive admin data.

Scoring

CVSS 6.4 ()
VectorCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
EPSS0.29% probability of exploitation · percentile 19.8% · 2026-10-05T12:00:23Z
Last modified2026-09-14
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.