Snipe-IT versions before 8.7.0 have a flaw where the CheckForTwoFactor middleware is enforced in the web group but not in the API group. This allows a user who has passed password authentication but not second-factor authentication to access the personal-access-token API flow. The attacker can generate a persistent API token that bypasses the second-factor challenge, enabling reading and modifying resources with the victim's permissions. For administrators, this includes access to the users/two_factor_reset endpoint, allowing the attacker to reset the administrator's second-factor enrollment, enroll their own factor, and take over the administrator's web account. The token does not create a web session but provides broad API access while the browser session remains blocked at the two-factor page. The issue is resolved in Snipe-IT version 8.7.0.

An attacker with password authentication and self.api permission can bypass second-factor authentication to obtain a persistent API token. This token allows the attacker to read and modify resources as the victim. For administrator accounts, the attacker can reset two-factor authentication settings, enroll their own factor, and take over the administrator's account, effectively locking out the legitimate user. This leads to account takeover and potential unauthorized access to sensitive IT asset and license management data.

This vulnerability is fixed in Snipe-IT version 8.7.0. Users should upgrade to version 8.7.0 or later to remediate this issue. No additional mitigation steps are required once the update is applied.