Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-86760

snipe-it 8.2.0 before 8.7.0 Authentication Bypass via activated flag

CVSS 4.0 5.3 MEDIUMCVSS 3.1 5.4 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-86760

Published

Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) contain an incorrect authorization flaw in app/Http/Controllers/Users/UsersController::update(). The single-user edit route assigned the activated field from the request payload before evaluating the canEditAuthFields authorization gate, so an authenticated non-admin user holding the users.edit permission in the target's company scope can submit a full valid PUT request to /users/{id} and toggle the activated flag on any user, including admin and superuser accounts. Deactivating an admin locks that account out of the application until another admin or superuser re-enables it. Only the activated field is affected; username, email, password and permissions remain protected by the gate, no data is disclosed, and the API (Api\UsersController::update) and bulk-edit paths are not affected.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-86760

Published

snipe-it

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "grokability",
                    "product": "snipe-it",
                    "defaultStatus": "unaffected",
                    "versions": [
                        {
                            "version": "8.2.0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThan": "8.7.0"
                        },
                        {
                            "version": "8.7.0",
                            "status": "unaffected",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON