Vulnerability · Published Sep 9, 2026 · Assigned by VulnCheck

CVE-2026-86754Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients

High 7.3

In plain English

A high-severity incorrect authorization in snipe-it from grokability. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.3%top 72.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. Attackers can trick administrators into approving consent screens, then exchange authorization codes for bearer tokens inheriting full admin API permissions lasting up to 40 years.

Affected products (as reported)

Vendor	Product	Versions
grokability	snipe-it	0 – before 8.7.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

References

GitHub Security Advisory (GHSA-gq7g-hxjg-8j27) vendor-advisory
VulnCheck Advisory: Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients third-party-advisory