Description
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable. This vulnerability is fixed in 8.4.1.
References (2)
Core 2
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/grokability/snipe-it/security/advisories/GHSA-mghp-5cq4-v6mg
X_Refsource_Misc x_refsource_misc
https://github.com/grokability/snipe-it/commit/e37649212861a337e68a624e589c3540b7a82373
Scores
CVSS v3
5.9
EPSS
0.0016
EPSS Percentile
5.8%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-601
Status
published
Products (3)
grokability/snipe-it
< 8.4.1
snipe/snipe-it
0 - 8.4.1Packagist
snipeitapp/snipe-it
< 8.4.1
Published
May 26, 2026
Tracked Since
May 27, 2026