Description

Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its existing API token continues to authenticate and to grant read and write access to the REST API (assets, users, licenses, etc.) at the account's prior permission level until the token expires. A deactivated account that retains user-management permissions can re-activate itself through the API, permanently defeating the deactivation control.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-09T14:17:26.220Z",
  "pubdate": "2026-09-09T14:17:26.220Z",
  "executiveSummary": "A critical authorization bypass vulnerability exists in Snipe-IT versions prior to 8.7.0 due to improper middleware implementation within the API authentication flow.\nThe vulnerability occurs because the 'CheckUserIsActivated' middleware is omitted from the 'api' middleware group defined in 'app/Http/Kernel.php'.\nConsequently, deactivated user accounts retain active access to the REST API via existing Laravel Passport personal access tokens, despite being restricted from web-based authentication.\nThe impact allows an unauthorized or deactivated user to maintain read and write access to sensitive assets, licenses, and user data. Furthermore, an attacker possessing sufficient permissions prior to deactivation can programmatically reactivate their own account via API requests, resulting in a persistent state of unauthorized access and privilege escalation.\nThis vulnerability effectively renders the 'deactivate' administrative control useless for API-based interactions, exposing the application to significant data breaches and unauthorized system modifications.",
  "technicalDetails": "The root cause of this vulnerability lies in an incomplete middleware enforcement strategy within the application's request lifecycle. In Snipe-IT, the web authentication layer correctly triggers the 'CheckUserIsActivated' middleware to verify the account status of a user; however, this security check is not applied to the 'api' middleware group located in 'app/Http/Kernel.php'.\nLaravel Passport, which handles token-based authentication for the API, validates the integrity and existence of a Personal Access Token but does not natively verify the current activation status of the associated user model unless explicitly instructed through middleware logic. Because the API route group bypasses the activation check, tokens issued to users remain valid even after the 'activated' flag on the corresponding user record in the database is set to false.\nThe attack flow proceeds as follows: 1) An attacker is issued a legitimate Passport personal access token while their account is active. 2) An administrator subsequently deactivates the user account through the web interface, expecting this to terminate all access. 3) The attacker, utilizing the pre-existing token, submits authenticated requests to the REST API. 4) The application authenticates the token, identifies the user, but fails to execute the activation check. 5) The attacker retains full CRUD (Create, Read, Update, Delete) privileges as defined by their prior role settings.\nThe post-exploitation impact is particularly severe if the deactivated account held user-management or administrative permissions. An attacker can leverage the persistent API access to issue requests that update the user record—specifically setting the 'activated' attribute back to true. By programmatically undoing the deactivation, the attacker bypasses the security control entirely, gaining persistent, unauthorized entry into the system. This allows for exfiltration of organizational inventory data, modification of license records, and potentially the elevation of privileges for other compromised accounts, all while the system administrator believes the malicious actor is locked out."
}