CVE-2026-86762: Snipe-IT before 8.7.0 Authentication Bypass via API Middleware
Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its existing API token continues to authenticate and to grant read and write access to the REST API (assets, users, licenses, etc.) at the account's prior permission level until the token expires. A deactivated account that retains user-management permissions can re-activate itself through the API, permanently defeating the deactivation control.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a personal access token that was issued to a user account before that account was deactivated. The token continues to provide the account's prior REST API permissions until it expires.
Are web logins also affected after a user is deactivated?
No. Deactivated accounts are correctly refused at web login; the issue is limited to existing Passport personal access tokens authenticating to the REST API.
What is the impact if the deactivated account had administrative permissions?
A deactivated account with user-management permissions can use its still-valid API token to reactivate itself. This permanently bypasses the intended deactivation control unless the token is revoked or expires.
How can an organization determine whether it is exposed?
Systems running Snipe-IT before 8.7.0 are affected. Review whether deactivated users have existing Passport personal access tokens, particularly tokens associated with accounts that previously had user-management or other high-privilege API access.
What can be done if upgrading is not immediately possible?
Revoke or otherwise invalidate personal access tokens belonging to deactivated users, since deactivation alone does not stop those tokens from authenticating. Prioritize tokens for accounts with user-management permissions because they can be used to reactivate the account.