Snipe-IT: 2FA bypass via the API token flow

Impact An attacker who knows a victim's password fully bypasses that account's 2FA and obtains a persistent token with full API access as the user read and write across the user's permissions, including admin if the victim is an admin. The token is an API credential, not a web/UI session using it...

CVE-2026-63493

Prior to version 8.7.0 , Snipe-IT is vulnerable to a 2FA bypass due to inconsistent middleware enforcement. While the web middleware group enforces CheckForTwoFactor, the API middleware group does not. An attacker with a password-authenticated session and self.api permissions can access the perso...

EUVD-2026-86291

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web...