grokability Snipe-IT up to 8.6.x API Middleware app/Http/Kernel.php improper authentication

Summaryinfo

A vulnerability classified as problematic was found in grokability Snipe-IT up to 8.6.x. This affects an unknown part of the file app/Http/Kernel.php of the component API Middleware. Such manipulation leads to improper authentication. This vulnerability is traded as CVE-2026-86762. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in grokability Snipe-IT up to 8.6.x. Affected by this issue is an unknown function of the file app/Http/Kernel.php of the component API Middleware. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its existing API token continues to authenticate and to grant read and write access to the REST API (assets, users, licenses, etc.) at the account's prior permission level until the token expires. A deactivated account that retains user-management permissions can re-activate itself through the API, permanently defeating the deactivation control.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-86762 since 09/08/2026. The exploitation is known to be easy. The attack may be launched remotely. Additional levels of successful authentication are needed for exploitation. There are known technical details, but no exploit is available.

By approaching the search of inurl:app/Http/Kernel.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 8.7.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• grokability

Name

• Snipe-IT

Version

• 8.0
• 8.1
• 8.2
• 8.3
• 8.4
• 8.5
• 8.6

Website

• Product: https://github.com/grokability/snipe-it/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion