Authentication Bypass in Snipe-IT Before 8.7.0

CVE-2026-86762

What is CVE-2026-86762?

A flaw in Snipe-IT versions prior to 8.7.0 allows for an authentication bypass through the API middleware. This occurs because the CheckUserIsActivated middleware is not applied to the 'api' middleware group. Consequently, when a user is deactivated, their Passport personal access tokens remain valid, permitting them to authenticate and access the REST API with the permissions that were previously granted. This oversight leads to a security risk where deactivated accounts can still execute read and write operations using existing API tokens until they naturally expire. Furthermore, these accounts can potentially re-activate themselves through the API, undermining the intended account deactivation process.

References