Incorrect authorization in snipe-it - CVE-2026-86760
Published: August 25, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU145100
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-86760
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to incorrect authorization in app/Http/Controllers/Users/UsersController::update() when handling a full valid PUT request to the single-user edit route. A remote user can submit a specially crafted request to deactivate admin or superuser accounts and cause a denial of service.
The issue is limited to the activated field. Username, email, password, and permissions cannot be modified through this path, and exploitation requires the users.edit permission on the target's company scope.
Affected software
snipe-it
How to mitigate CVE-2026-86760
Install security update from vendor's website.
snipe-it - update to 8.7.0