Snipe-IT before 8.6.3: deactivated users can sign back in via Google SSO (CVE-2026-116199)

This is effectively an offboarding gap. In Snipe-IT through 8.6.2, a user who had been deactivated could sign back in through Google SSO and regain their original permissions, including admin. The person getting in is the former user, using their own Google account. It is not a way to log in as someone else.

What has to be true

Google SSO must be enabled, and the account's username must be an email address or an email-shaped value. The user must be deactivated in Snipe-IT while their Google identity is still live. The Google callback logged in whichever user's username matched the Google email without checking the activated flag. Snipe-IT's advisory says the default firstname.lastname username format was not affected, even with SSO on.

Timeline and scores

The fix landed in v8.6.3 on Jun 15 (commit "check for activated flag"); the release notes don't name it. Snipe-IT's advisory went public Oct 8, and the CVE was assigned and published Oct 25. The scores are VulnCheck's: CVSS 3.1 8.1 High and CVSS 4.0 9.2 Critical. Snipe-IT's own advisory rates it Moderate, and NVD has received the record but hasn't scored it. It was not in CISA's KEV catalog as of its Oct 23 release, and no public proof of concept or in-the-wild exploitation turned up. The reporter is credited as builtbybrayden.

What to do
Upgrade to the current release, v8.8.3 (published Oct 21-22). Don't stop at 8.6.3: a separate username-collation bypass, CVE-2026-86770, affects 8.6.3 and below and is fixed in 8.7.0. Also deactivate or remove Google identities as part of offboarding, so a Snipe-IT account isn't the only thing standing between a former user and the system.

Sources: GitHub advisory, VulnCheck advisory, NVD, CVE.org record