{"id":"CVE-2026-86760","title":"Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) contain an incorrect authorization flaw in app/Http/Controllers/Users/UsersController::update()","summary":"Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) contain an incorrect authorization flaw in app/Http/Controllers/Users/UsersController::update(). The single-user edit route assigned the activated field from the request payload befo…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cwe":["CWE-863"],"vendor":"snipeitapp","product":"snipe-it","affected":["snipe-it >= 8.2.0, < 8.7.0"],"patched":["snipe-it 8.7.0"],"published":"2026-09-09","updated":"2026-09-16","sourceUpdated":"2026-09-16T20:26:45.730","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86760","references":[{"url":"https://github.com/grokability/snipe-it/commit/02f62c8dce7bee118a07882823cd1ad098360a17","label":"disclosure@vulncheck.com"},{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-xq9q-777w-q9h7","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/snipe-it-8.2.0-before-8.7.0-authentication-bypass-via-activated-flag","label":"disclosure@vulncheck.com"},{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-xq9q-777w-q9h7","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00218,"epssPercentile":0.12548,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-14T13:26:55.689029Z"},"ingestedAt":"2026-09-14T15:23:07.419Z","slug":"CVE-2026-86760","body":"## Overview\n\nSnipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) contain an incorrect authorization flaw in app/Http/Controllers/Users/UsersController::update(). The single-user edit route assigned the activated field from the request payload before evaluating the canEditAuthFields authorization gate, so an authenticated non-admin user holding the users.edit permission in the target's company scope can submit a full valid PUT request to /users/{id} and toggle the activated flag on any user, including admin and superuser accounts. Deactivating an admin locks that account out of the application until another admin or superuser re-enables it. Only the activated field is affected; username, email, password and permissions remain protected by the gate, no data is disclosed, and the API (Api\\UsersController::update) and bulk-edit paths are not affected.\n\n## Affected\n\n- `snipe-it >= 8.2.0, < 8.7.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `snipe-it 8.7.0`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":200102,"id":"CVE-2026-86760","ts":1789395646963,"field":"exploit_available","old":"false","new":"true"}]}