CVE-2026-86762

HighCVSS 8.1/10Last modified Sep 16, 2026

Description

Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its existing API token continues to authenticate and to grant read and write access to the REST API (assets, users, licenses, etc.) at the account's prior permission level until the token expires. A deactivated account that retains user-management permissions can re-activate itself through the API, permanently defeating the deactivation control.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
grokability	snipe-it	>= 8.6.3, < 8.7.0

References

https://github.com/grokability/snipe-it/commit/b3f12f974bb2c0175ea68dad163ed04726db4280Patch
https://github.com/grokability/snipe-it/security/advisories/GHSA-cj4w-vx6j-42rfExploit, Vendor Advisory
https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-authentication-bypass-via-api-middlewareThird Party Advisory

Timeline

Published: Sep 9, 2026
Last modified: Sep 16, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-867633.5Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authorization bypass in the Livewire importer component (App\Livewire\Importer, mounted CVE-2026-867646.5Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware/<CVE-2026-867656.5Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Aut CVE-2026-867666.5Snipe-IT versions up to and including 8.6.3 contain a race condition (TOCTOU) in the consumable checkout API endpoint (POST /api/v1/consumab CVE-2026-867675.0Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Supp CVE-2026-867685.4Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions CVE-2026-867694.3Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records CVE-2026-86776.4The Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages plugin for WordPress is vulnerable to Stored Cross-Site Scriptin CVE-2026-867708.1Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as differen CVE-2026-867717.6Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing attackers with users.edi CVE-2026-867725.4Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink() where departm CVE-2026-867735.4Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and upda