# CVE-2026-86762: Snipe-IT authentication bypass via deactivated user API tokens

Source: https://junglewise.ai/threats/cve-2026-86762-snipe-it-authentication-bypass-via-deactivated-user-api-tokens  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86762 · Severity: high · CVSS 8.1 · Published 2026-09-09

Snipe-IT is asset inventory management software used by organizations to track hardware and licenses. When an administrator deactivates a user account to revoke access—such as when an employee leaves or credentials are compromised—the deactivation is enforced only on the web login portal. A deactivated user's existing API tokens continue to grant full read and write access to sensitive asset data until the token naturally expires. Additionally, deactivated users with administrative permissions can reactivate themselves through the API, permanently defeating the access control.

Technologies: [Snipeitapp Snipe-It](https://junglewise.ai/threats/technologies/snipe-it). Vendors: [Snipeitapp](https://junglewise.ai/threats/vendors/snipeitapp).

## Quick answers

**Is CVE-2026-86762 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86762 being exploited in the wild.

**How severe is CVE-2026-86762?** High severity, with a CVSS score of 8.1, published 9 September 2026.

**Which products and versions are affected?** Grokability Snipe-IT before 8.7.0.

**Is there a fix for CVE-2026-86762?** A patch was published on 2026-07-25: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86762 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86762?** Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass caused by missing middleware validation on the API authentication path. The CheckUserIsActivated middleware exists in the web middleware group and correctly blocks deactivated users at login, but it is not applied to the api middleware group in app/Http/Kernel.php. Additionally, when a user is deactivated, the application does not revoke their Passport personal access tokens, allowing them to continue authenticating via API with their prior permission level. The attack vector is network-based; any attacker with a deactivated user's API token can invoke REST API endpoints (hardware, users, licenses, etc.) without any additional preconditions. A deactivated account holding user-management permissions can call the user update API to reactivate itself, permanently bypassing the deactivation control. The fix (version 8.7.0) adds CheckUserIsActivated to the api middleware group.

## Affected products

- Grokability Snipe-IT before 8.7.0

## Timeline

- 2026-08-24: disclosed
- 2026-09-09: advisory: NVD published
- 2026-07-25: patched: Fix committed to repository

## References

- [https://github.com/grokability/snipe-it/commit/b3f12f974bb2c0175ea68dad163ed04726db4280](https://github.com/grokability/snipe-it/commit/b3f12f974bb2c0175ea68dad163ed04726db4280)
- [https://github.com/grokability/snipe-it/security/advisories/GHSA-cj4w-vx6j-42rf](https://github.com/grokability/snipe-it/security/advisories/GHSA-cj4w-vx6j-42rf)

## Related threats

- [Snipe-IT broken access control in Asset Model file attachments](https://junglewise.ai/threats/cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments)
- [Snipe-IT broken access control in Predefined Kit endpoints](https://junglewise.ai/threats/cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints)
- [Snipe-IT stored cross-site scripting in department names](https://junglewise.ai/threats/cve-2026-86772-snipe-it-stored-cross-site-scripting-in-department-names)
- [Snipe-IT acceptance PDF server-side request forgery via unescaped employee_num](https://junglewise.ai/threats/cve-2026-86771-snipe-it-acceptance-pdf-server-side-request-forgery-via-unescaped)
- [Snipe-IT authentication bypass in SAML username collation](https://junglewise.ai/threats/cve-2026-86770-snipe-it-authentication-bypass-in-saml-username-collation)