CyberRota Analysis
AI-GeneratedSnipe-IT versions prior to 8.7.0 are vulnerable to an authorization bypass in Livewire components, allowing authenticated attackers to exploit component lifecycle methods. This can lead to privilege escalation, enabling unauthorized actions such as creating OAuth clients, minting personal access tokens, and accessing sensitive admin data. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized access and data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within component lifecycle methods. Attackers with a valid authenticated session can replay signed component snapshots via POST /livewire/update to invoke protected methods and escalate privileges, including creating OAuth clients, minting personal access tokens, and accessing sensitive admin data.
Related CVEs
Other vulnerabilities affecting the same vendor(s)