Improper Authentication in snipe-it - #VU154179
Published: October 13, 2026
Vulnerability identifier: #VU154179
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass account deactivation and regain authenticated access at the account's original permission level.
The vulnerability exists due to improper authentication in GoogleAuthController::handleGoogleCallback when handling Google SSO callbacks without checking the local user's activated flag. A remote user can sign in with still-valid Google credentials associated with a deactivated local account to bypass account deactivation and regain authenticated access at the account's original permission level.
Exploitation requires the local username to match the Google identity's email address.
Affected software
snipe-it
Remediation
Install security update from vendor's website.
snipe-it - update to 8.6.3