# CVE-2026-86760: Snipe-IT authorization bypass in user account activation toggle

Source: https://junglewise.ai/threats/cve-2026-86760-snipe-it-authorization-bypass-in-user-account-activation-toggle  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86760 · Severity: medium · CVSS 5.4 · Published 2026-09-09

Snipe-IT is an open-source asset management system used by organizations to track hardware, software, and inventory. A flaw in the user edit feature allows employees with basic user-edit permissions to disable admin accounts, locking them out of the system until another administrator re-enables them. This can disrupt operations and lock legitimate administrators out of critical business systems.

Technologies: [Snipeitapp Snipe-It](https://junglewise.ai/threats/technologies/snipe-it). Vendors: [Snipeitapp](https://junglewise.ai/threats/vendors/snipeitapp).

## Quick answers

**Is CVE-2026-86760 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86760 being exploited in the wild.

**How severe is CVE-2026-86760?** Medium severity, with a CVSS score of 5.4, published 9 September 2026.

**Which products and versions are affected?** Snipe-IT Snipe-IT 8.2.0 through 8.6.x (fixed in 8.7.0).

**Is there a fix for CVE-2026-86760?** A patch was published on 2026-09-09: Fix released in version 8.7.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86760 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86760?** Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an authorization bypass vulnerability (CWE-269) in the UsersController::update() method. The vulnerable code assigns the activated field from the request payload before evaluating the canEditAuthFields authorization gate; when authorization fails, the pre-gated assignment persists and is saved to the database. An authenticated attacker holding the users.edit permission can craft a PUT request to /users/{id} with activated=0 to deactivate any user, including admin and superuser accounts. The vulnerability requires authentication and the users.edit permission scoped to the target's company, but affects only the activated field; sensitive fields (username, email, password, permissions) remain protected by the authorization gate, and the API and bulk-edit paths are unaffected. The patch (v8.7.0) moves all activated field assignments inside the authorization gate.

## Affected products

- Snipe-IT Snipe-IT 8.2.0 through 8.6.x (fixed in 8.7.0)

## Timeline

- 2026-09-09: disclosed
- 2026-09-09: patched: Fix released in version 8.7.0

## References

- [https://github.com/grokability/snipe-it/commit/02f62c8dce7bee118a07882823cd1ad098360a17](https://github.com/grokability/snipe-it/commit/02f62c8dce7bee118a07882823cd1ad098360a17)
- [https://github.com/grokability/snipe-it/security/advisories/GHSA-xq9q-777w-q9h7](https://github.com/grokability/snipe-it/security/advisories/GHSA-xq9q-777w-q9h7)

## Related threats

- [Snipe-IT broken access control in Asset Model file attachments](https://junglewise.ai/threats/cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments)
- [Snipe-IT broken access control in Predefined Kit endpoints](https://junglewise.ai/threats/cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints)
- [Snipe-IT stored cross-site scripting in department names](https://junglewise.ai/threats/cve-2026-86772-snipe-it-stored-cross-site-scripting-in-department-names)
- [Snipe-IT acceptance PDF server-side request forgery via unescaped employee_num](https://junglewise.ai/threats/cve-2026-86771-snipe-it-acceptance-pdf-server-side-request-forgery-via-unescaped)
- [Snipe-IT authentication bypass in SAML username collation](https://junglewise.ai/threats/cve-2026-86770-snipe-it-authentication-bypass-in-saml-username-collation)