Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its existing API token continues to authenticate and to grant read and write access to the REST API (assets, users, licenses, etc.) at the account's prior permission level until the token expires. A deactivated account that retains user-management permissions can re-activate itself through the API, permanently defeating the deactivation control.
References
| Link | Resource |
|---|---|
| https://github.com/grokability/snipe-it/commit/b3f12f974bb2c0175ea68dad163ed04726db4280 | Patch |
| https://github.com/grokability/snipe-it/security/advisories/GHSA-cj4w-vx6j-42rf | Exploit Vendor Advisory |
| https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-authentication-bypass-via-api-middleware | Third Party Advisory |
Configurations
History
16 Sep 2026, 20:27
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* | |
| First Time |
Snipeitapp snipe-it
Snipeitapp |
|
| References | () https://github.com/grokability/snipe-it/commit/b3f12f974bb2c0175ea68dad163ed04726db4280 - Patch | |
| References | () https://github.com/grokability/snipe-it/security/advisories/GHSA-cj4w-vx6j-42rf - Exploit, Vendor Advisory | |
| References | () https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-authentication-bypass-via-api-middleware - Third Party Advisory |
Information
Published : 2026-09-09 14:17
Updated : 2026-09-16 20:27
NVD link : CVE-2026-86762
Mitre link : CVE-2026-86762
CVE.ORG link : CVE-2026-86762
JSON object : View
Products Affected
snipeitapp
- snipe-it
CWE
CWE-862
Missing Authorization