CVE-2026-86760 grokability CVE debrief

Who should care

Defenders responsible for Snipe-IT deployments, particularly those with versions 8.2.0 through 8.6.x, should assess exposure and apply the vendor-provided patch. IT administrators and security teams managing user accounts and permissions in Snipe-IT should prioritize verifying and mitigating this vulnerability to prevent potential account lockouts.

Why it matters

CVE-2026-86760 is an incorrect authorization vulnerability in Snipe-IT that allows authenticated non-admin users to toggle the activated flag on any user account, potentially locking out admin accounts. Defenders should verify exposure, apply the vendor-provided patch, and restrict users.edit permissions to trusted roles.

• Authenticated users can lock out admin accounts
• Potential disruption to user account management
• Requires verification of Snipe-IT version and exposure
• Patching to 8.7.0 may be necessary to mitigate vulnerability

Technical summary

The Snipe-IT application has an incorrect authorization vulnerability in the UsersController::update() method. Specifically, the code assigns the activated field from the request payload before evaluating the canEditAuthFields authorization gate. This allows an authenticated non-admin user with the users.edit permission in the target's company scope to submit a PUT request to /users/{id} and toggle the activated flag on any user, including admin and superuser accounts.

Defensive priority

Defenders should prioritize verifying exposure and applying the vendor-provided patch to prevent potential account lockouts.

Recommended defensive actions

• Verify Snipe-IT version and apply patch to 8.7.0 if vulnerable
• Restrict users.edit permission to trusted roles
• Monitor user account status and activation changes
• Implement additional logging and auditing for user updates
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Snipe-IT versions 8.2.0 through 8.6.x. Additional information on potential exploitation or impact is limited, but defenders should verify exposure and apply the vendor-provided patch to prevent potential account lockouts. The vulnerability allows authenticated non-admin users to toggle the activated flag on any user account, potentially locking out admin accounts. Defenders should assess Snipe-IT deployments, particularly those with versions 8.2.0 through 8.6.x, and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.