Grokability Snipe-IT up to 8.6.x User Edit Route UsersController.php update activated improper authorization

Summaryinfo

A vulnerability, which was classified as problematic, was found in Grokability Snipe-IT up to 8.6.x. This issue affects the function app/Http/Controllers/Users/UsersController::update of the file app/Http/Controllers/Users/UsersController.php of the component User Edit Route. Executing a manipulation of the argument activated can lead to improper authorization. This vulnerability is handled as CVE-2026-86760. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in Grokability Snipe-IT up to 8.6.x and classified as problematic. This vulnerability affects the function app/Http/Controllers/Users/UsersController::update of the file app/Http/Controllers/Users/UsersController.php of the component User Edit Route. The manipulation of the argument activated with an unknown input leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect integrity, and availability. CVE summarizes:

Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) contain an incorrect authorization flaw in app/Http/Controllers/Users/UsersController::update(). The single-user edit route assigned the activated field from the request payload before evaluating the canEditAuthFields authorization gate, so an authenticated non-admin user holding the users.edit permission in the target's company scope can submit a full valid PUT request to /users/{id} and toggle the activated flag on any user, including admin and superuser accounts. Deactivating an admin locks that account out of the application until another admin or superuser re-enables it. Only the activated field is affected; username, email, password and permissions remain protected by the gate, no data is disclosed, and the API (Api\UsersController::update) and bulk-edit paths are not affected.

The advisory is available at github.com. This vulnerability was named CVE-2026-86760 since 09/08/2026. The exploitation appears to be easy. The attack can be initiated remotely. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1548.002 by the MITRE ATT&CK project.

By approaching the search of inurl:app/Http/Controllers/Users/UsersController.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 8.7.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Grokability

Name

• Snipe-IT

Version

• 8.0
• 8.1
• 8.2
• 8.3
• 8.4
• 8.5
• 8.6

Website

• Product: https://github.com/grokability/snipe-it/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion