CVE-2026-86762

    Dashboard / Vulnerabilities / CVE-2026-86762

    CVE-2026-86762

    Published: 9 Sept 2026Last Modified: 12 Sept 2026

    Summary: Snipe-IT before 8.7.0 Authentication Bypass via API Middleware

    Details: Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its existing API token continues to authenticate and to grant read and write access to the REST API (assets, users, licenses, etc.) at the account's prior permission level until the token expires. A deactivated account that retains user-management permissions can re-activate itself through the API, permanently defeating the deactivation control.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86762.json, https://github.com/grokability/snipe-it/security/advisories/GHSA-cj4w-vx6j-42rf, https://nvd.nist.gov/vuln/detail/CVE-2026-86762, https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-authentication-bypass-via-api-middleware, https://github.com/grokability/snipe-it/commit/b3f12f974bb2c0175ea68dad163ed04726db4280

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- cfd1ff8413e478a8daab700c15e96c96f93220e2
    Fixed -1d05a7ce11e6bf9448c067ac3ffbe5e63882888e

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-86762 | CVE-DB