CyberRota Analysis
AI-GeneratedSnipe-IT versions prior to 8.7.0 are vulnerable due to a failure to apply the CheckUserIsActivated middleware to the API, allowing deactivated users to retain their Passport personal access tokens. This oversight enables these users to continue accessing the REST API with their previous permissions, potentially compromising sensitive data and user management capabilities. Organizations using Snipe-IT should prioritize upgrading to version 8.7.0 or later to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its existing API token continues to authenticate and to grant read and write access to the REST API (assets, users, licenses, etc.) at the account's prior permission level until the token expires. A deactivated account that retains user-management permissions can re-activate itself through the API, permanently defeating the deactivation control.