CVE-2026-86760

Name of the Vulnerable Software and Affected Versions Snipe-IT versions 8.2.0 through 8.6.x

Description An incorrect authorization flaw exists in the update() function within app/Http/Controllers/Users/UsersController. The single-user edit route assigns the activated field from the request payload before evaluating the canEditAuthFields authorization gate. This allows an authenticated non-admin user with the users.edit permission in the target's company scope to send a PUT request to the '/users/{id}' endpoint and toggle the activated flag for any user, including admin and superuser accounts. Deactivating an admin account results in that account being locked out of the application. Only the activated field is affected; other sensitive data and the API are not impacted.

Recommendations Update to version 8.7.0.