The vulnerability in Snipe-IT versions prior to 8.7.0 allows an attacker to bypass authentication by continuing to use an existing Passport personal access token after the corresponding user account has been deactivated. Because the CheckUserIsActivated middleware is absent from the api middleware group, the token is not invalidated and provides full read and write access to the REST API, including assets, users, and licenses, until the token expires. This missing authorization check (CWE-862) effectively grants the attacker persistence and administrative control over the system, allowing them to re‑activate the deactivated account via the API and permanently defeat deactivation controls.

The affected product is Snipe-IT, an open‑source asset management application, from the vendor Grokability. All deployments running any version prior to 8.7.0 are impacted; the fix was introduced in release 8.7.0.

The CVSS score of 8.6 indicates a high‑severity security flaw. Although the EPSS score is not available, the lack of an exploit listing in CISA’s KEV catalog and the requirement for a valid API token suggest the attack may be limited to users who have already obtained such a token, but once possession is achieved the impact is severe. The missing authorization check allows an attacker to maintain API access and recover deactivated accounts, representing a significant risk to confidentiality, integrity, and availability of the asset inventory.