A password‑authenticated session can invoke the personal‑access‑token API flow before a two‑factor challenge completes because the CheckForTwoFactor check is applied only to the web middleware group and not the API middleware group. The resulting API token is persistent and grants the same level of read, write, and administrative access as the original account, allowing an attacker to read or modify data, reset an administrator’s two‑factor authentication and lock out legitimate users, and ultimately hijack the administrator’s web account. The impact is loss of confidentiality, integrity, and availability of protected resources and escalation of privileges to system‑administrator level.

Snipe‑IT installations running any version older than 8.7.0 are vulnerable. The weakness specifically affects accounts that have the self.api permission enabled.

The CVSS score of 8.6 indicates a high severity threat. The exploit requires only a valid password for an account with self.api rights, so an attacker with credential compromise can immediately generate the API token. Because the EPSS score is not published and the vulnerability is not listed in CISA’s KEV catalog, the exact exploitation prevalence is unclear, but the high CVSS combined with the ability to lock out legitimate users and take over an administrator account makes it a significant risk to any deployment.