An incorrect authorization logic in the user update controller allows an authenticated user who holds the users.edit permission within the same company scope to toggle the activated flag on any user account, including administrators and superusers. The vulnerability affects only the activated attribute; name, email, password, and permission data remain protected, and no external data exposure occurs. The ability to deactivate an admin account effectively locks that account out of the application until another privileged user re‑enables it.

The vulnerability affects Snipe-IT versions 8.2.0 through 8.6.x, prior to the 8.7.0 release, as distributed by Snipe‑IT App. The affected versions are 8.2.0–8.6.x. The flaw resides in the UsersController::update endpoint; bulk‑edit paths are not impacted.

The CVSS score is 5.3, indicating medium severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector requires an authenticated session with the users.edit permission within the target company. While no data is disclosed or code executed, the attacker can toggle any user’s activation status, potentially locking out administrators or superusers until another privileged user re-enables the account. The overall risk is moderate due to the potential account lockout and the need for privileged permissions.