CVE-2026-86762

Undergoing Analysis Undergoing Analysis - In Progress

Authentication Bypass in Snipe-IT via Unrevoked API Tokens

Publication date: 2026-09-09

Last updated on: 2026-09-10

Assigner: VulnCheck

Description

Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its existing API token continues to authenticate and to grant read and write access to the REST API (assets, users, licenses, etc.) at the account's prior permission level until the token expires. A deactivated account that retains user-management permissions can re-activate itself through the API, permanently defeating the deactivation control.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-10

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86762

EUVD

EUVD-2026-74939

Affected Vendors & Products

Vendor	Product	Version / Range
snipe-it	snipe-it	to 8.7.0 (exc)
grokability	snipe-it	to 8.7.0 (exc)
grokability	snipe-it	8.6.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-86762 is an authentication bypass vulnerability in Snipe-IT versions before 8.7.0. When a user is deactivated, their existing API tokens remain valid, allowing continued access to the REST API at the user's prior permission level. The CheckUserIsActivated middleware was not applied to the API middleware group, so deactivated users could still perform API actions, including reactivating themselves.

Detection Guidance

Check for deactivated user accounts with active API tokens by reviewing Snipe-IT's user and token logs. Look for users marked as deactivated but with recent API activity. Use commands like 'php artisan passport:tokens' to list active tokens and cross-reference with 'php artisan snipeit:users --deactivated' to identify mismatches.

Impact Analysis

This vulnerability allows deactivated user accounts to retain full API access, potentially enabling unauthorized read and write operations on sensitive data like assets, users, and licenses. Attackers could exploit this to manipulate inventory, reactivate accounts, or create new accounts if the deactivated user had user-management permissions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data through the API, potentially violating GDPR's data protection requirements and HIPAA's access controls. Deactivated users retaining API access may expose personal or health data without proper authorization.

Mitigation Strategies

Upgrade Snipe-IT to version 8.7.0 or later immediately. Revoke all existing API tokens for deactivated users using 'php artisan passport:revoke' and audit token permissions. Ensure the CheckUserIsActivated middleware is applied to the API middleware group in app/Http/Kernel.php.

Hi! I’m here to help you understand CVE-2026-86762. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70