Incorrect authorization in snipe-it - CVE-2026-86754
Published: August 25, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU145093
CSH Severity: Low
CVSS v4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-86754
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to obtain an admin API token and access privileged API data.
The vulnerability exists due to improper access control in the /oauth/clients routes when handling OAuth client management requests and subsequent OAuth consent flows. A remote user can register an OAuth client with an attacker-controlled redirect URI and trick an admin into approving the consent screen to obtain an admin API token and access privileged API data.
User interaction is required for an admin to approve the OAuth consent screen, and the resulting bearer token inherits the approving admin's API permissions.
Affected software
snipe-it
How to mitigate CVE-2026-86754
Install security update from vendor's website.
snipe-it - update to 8.7.0