Snipe-IT CVE-2026-86746

Exploitation requires a valid authenticated session at any privilege level - unauthenticated access is insufficient. The attacker must be able to reach POST /livewire/update on the target Snipe-IT instance over the network. The target must be running a version before 8.7.0. The attacker must understand the Livewire signed-snapshot format sufficiently to craft or replay a payload targeting a protected lifecycle method, which raises attack complexity to High. No special non-default configuration is required - the vulnerable code path is present in any standard deployment of an affected version. Exploitation is bounded to confidentiality and integrity impacts; availability is not affected.

The CVSS 4.0 score of 7.4 with vector AV:N/AC:H/AT:P/PR:L/UI:P reflects that exploitation requires a valid authenticated session and meaningful complexity in understanding and crafting signed Livewire snapshots. Real-world risk is nonetheless significant: Snipe-IT is broadly deployed across enterprise IT departments and government environments, and even a mid-sized municipal IT team in radom should treat this as urgent because any authenticated user - including low-privilege staff - can silently escalate to admin-equivalent access by minting durable personal access tokens. The VC:H/VI:H impact metrics confirm full compromise of sensitive admin data confidentiality and system integrity. No CISA KEV listing and no public PoC have been identified at time of analysis, which moderates immediacy but does not diminish the severity given the low barrier to exploitation once an authenticated foothold exists.

An attacker authenticates to Snipe-IT as a low-privilege user, then intercepts or reconstructs a signed Livewire snapshot for an admin-restricted component - such as the OAuth application management interface - and replays it via a crafted POST to /livewire/update. The server invokes the protected lifecycle method without re-validating authorization, creating an OAuth client or personal access token that the attacker retains for persistent privileged API access. No public PoC has been identified, but the attack requires only familiarity with Livewire's documented snapshot signing mechanism.