CVE-2026-86762: Missing Authorization in grokability snipe-it
Snipe-IT versions before 8.7.0, including version 8.6.3, do not enforce user activation checks on API requests, allowing deactivated users' existing API tokens to continue granting access. This enables a deactivated user with API tokens to maintain read and write access to the REST API and potentially reactivate their account via the API, bypassing deactivation controls.
AI Analysis
Technical Summary
CVE-2026-86762 affects Snipe-IT before version 8.7.0 due to the absence of the CheckUserIsActivated middleware in the api middleware group. Deactivating a user does not revoke their Passport personal access tokens, allowing continued API access at the user's prior permission level until token expiration. This flaw permits a deactivated user with user-management permissions to reactivate their account through the API, effectively negating the deactivation.
Potential Impact
Deactivated users retain API access via existing tokens, allowing unauthorized read and write operations on assets, users, licenses, and other REST API resources. Users with management permissions can reactivate their accounts through the API, permanently bypassing deactivation controls until tokens expire.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider manual revocation of personal access tokens upon user deactivation as a temporary mitigation.
CVE-2026-86762: Missing Authorization in grokability snipe-it
Description
Snipe-IT versions before 8.7.0, including version 8.6.3, do not enforce user activation checks on API requests, allowing deactivated users' existing API tokens to continue granting access. This enables a deactivated user with API tokens to maintain read and write access to the REST API and potentially reactivate their account via the API, bypassing deactivation controls.
CVSS v4.0
Score 8.6high
Affected software
pkg:github/grokability/snipe-itRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-86762 affects Snipe-IT before version 8.7.0 due to the absence of the CheckUserIsActivated middleware in the api middleware group. Deactivating a user does not revoke their Passport personal access tokens, allowing continued API access at the user's prior permission level until token expiration. This flaw permits a deactivated user with user-management permissions to reactivate their account through the API, effectively negating the deactivation.
Potential Impact
Deactivated users retain API access via existing tokens, allowing unauthorized read and write operations on assets, users, licenses, and other REST API resources. Users with management permissions can reactivate their accounts through the API, permanently bypassing deactivation controls until tokens expire.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider manual revocation of personal access tokens upon user deactivation as a temporary mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-08T11:33:02.641Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6aa164b9acd9273b496859b3
Added to database: 09/09/2026, 13:52:57 UTC
Last enriched: 09/09/2026, 14:07:38 UTC
Last updated: 09/09/2026, 18:34:33 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.