Description

Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within component lifecycle methods. Attackers with a valid authenticated session can replay signed component snapshots via POST /livewire/update to invoke protected methods and escalate privileges, including creating OAuth clients, minting personal access tokens, and accessing sensitive admin data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-09T14:17:23.420Z",
  "pubdate": "2026-09-09T14:17:23.420Z",
  "executiveSummary": "Snipe-IT versions prior to 8.7.0 are susceptible to an authorization bypass vulnerability stemming from insufficient access control validation within Livewire components. The flaw exists because security enforcement is applied exclusively at the route level rather than within individual component lifecycle methods. Consequently, an attacker possessing a valid authenticated session can manipulate signed Livewire component snapshots to invoke unauthorized backend methods. This vulnerability permits authenticated users to escalate privileges, leading to unauthorized actions such as the creation of OAuth clients, the generation of personal access tokens, and the exfiltration of sensitive administrative data. The risk is critical, as it undermines the integrity of the application's access control model, allowing standard users to perform actions restricted to administrators. Successful exploitation requires an active, authenticated session and the ability to intercept and replay component state updates, posing a significant threat to data confidentiality and systemic security integrity.",
  "technicalDetails": "The vulnerability resides in the architectural oversight where Snipe-IT relies on Laravel's routing middleware for authorization, failing to extend these security checks to the internal lifecycle methods of Livewire components. Livewire functions by maintaining a stateful connection between the server and client via signed snapshots of component properties. When a component interacts with the server, it sends a POST request to the '/livewire/update' endpoint containing these signed payloads.\nBecause the authorization logic is isolated to the routing layer, once a request reaches a Livewire component, the component assumes that the request is authorized by virtue of the route being accessed. However, attackers can bypass this by replaying or modifying signed component snapshots. By crafting a POST request to '/livewire/update' with a valid, signed snapshot, an attacker can trigger method calls within the component that perform sensitive operations, such as user creation, token generation, or privilege modification. Since the internal method itself lacks an explicit 'authorize()' call or authorization middleware check, the server-side component executes the logic regardless of the current user's session-level permissions.\nThe attack flow follows a specific progression: First, the attacker identifies a protected Livewire component reachable within their authenticated session. Second, the attacker intercepts the traffic sent to the '/livewire/update' endpoint to capture the signed snapshot associated with that component. Third, the attacker manipulates the payload—or replays a legitimate payload that calls a privileged method—within the context of the component. Because the application logic fails to re-validate the user's role against the specific action requested within the component method, the server processes the state change and executes the administrative function. This effectively elevates the attacker's capability to that of an administrator, facilitating full system compromise through the creation of malicious OAuth clients or personal access tokens for persistent, unauthorized access to sensitive data and administrative settings. The vulnerability is present in all Snipe-IT versions before 8.7.0."
}