CVE-2026-86762

Snipe-IT before 8.7.0 fails to apply the CheckUserIsActivated middleware to its API middleware group and does not revoke a user's Passport personal access tokens when that user is deactivated (CWE-862). An attacker or former employee holding an existing API token for a deactivated account can therefore continue calling the REST API — reading and modifying assets, users, licenses, and other records — at the account's prior permission level until the token expires, even though web login is correctly blocked. If the deactivated account retains user-management permissions, it can even reactivate itself through the API, permanently undoing the deactivation control. All Snipe-IT deployments running a version before 8.7.0 in which deactivated users held issued API tokens are affected. There is no evidence of in-the-wild exploitation, no public proof-of-concept, and the issue is not in the CISA KEV catalog.

What to do: Upgrade to Snipe-IT 8.7.0 or later. As an interim mitigation, manually revoke the Passport personal access tokens of any deactivated users (delete their oauth_access_tokens entries) and audit recently deactivated accounts for API activity, including unexpected self-reactivation or changes made at their former permission level.