Executive brief
Snipe-IT is an IT asset management system that allows teams to track hardware, software, and other resources across an organization. An attacker who knows a user's password can completely bypass that user's two-factor authentication (2FA) by obtaining a long-lived API token with full read/write access. If the compromised account is an admin, the attacker can also disable 2FA protection, lock the legitimate user out, and take over the account's web access.
Technical details
The vulnerability stems from inconsistent 2FA enforcement: the CheckForTwoFactor middleware is registered only on the web middleware group, not the API group. After a user authenticates with a correct password, they can access the /two-factor endpoint (which is explicitly exempted from 2FA checks) to obtain a Passport API token cookie, then use the unauthenticated API group to mint a persistent personal access token via /api/v1/account/personal-access-tokens. This token grants full API access without ever requiring the second factor, and since the API endpoint is gated only by a permission check (not 2FA validation), any user with the self.api permission can generate tokens. The exploit requires only knowledge of the target's password; no user interaction or additional authentication is needed. The fix adds EnforceApiTwoFactorEnrollment middleware to the API group to verify 2FA enrollment status before issuing or accepting API tokens.
Affected products
- Snipe-IT Snipe-IT prior to commit 87c362962a
Timeline
- 2026-09-24: disclosed: Advisory published
- 2026-09-24: patched: Fixed via commit 87c362962a and PR #19294