Quick answers
- Is CVE-2026-86760 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-86760 being exploited in the wild.
- How severe is CVE-2026-86760?
- Medium severity, with a CVSS score of 5.4, published 9 September 2026.
- Which products and versions are affected?
- Snipe-IT Snipe-IT 8.2.0 through 8.6.x (fixed in 8.7.0).
- Is there a fix for CVE-2026-86760?
- A patch was published on 2026-09-09: Fix released in version 8.7.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-86760 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-86760?
- Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is an authorization bypass vulnerability (CWE-269) in the UsersController::update() method. The vulnerable code assigns the activated field from the request payload before evaluating the canEditAuthFields authorization gate; when authorization fails, the pre-gated assignment persists and is saved to the database. An authenticated attacker holding the users.edit permission can craft a PUT request to /users/{id} with activated=0 to deactivate any user, including admin and superuser accounts. The vulnerability requires authentication and the users.edit permission scoped to the target's company, but affects only the activated field; sensitive fields (username, email, password, permissions) remain protected by the authorization gate, and the API and bulk-edit paths are unaffected. The patch (v8.7.0) moves all activated field assignments inside the authorization gate.
Affected products
- Snipe-IT Snipe-IT 8.2.0 through 8.6.x (fixed in 8.7.0)
Timeline
- 2026-09-09: disclosed
- 2026-09-09: patched: Fix released in version 8.7.0