Read the docs
TI-2021-02789 Aliases CVE-2021-3858GHSA-g92x-8m54-p89v

Cross-Site Request Forgery (CSRF) in snipe/snipe-it

Priority LOW 39CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)

Why it matters now

EPSS 0.00544 45th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed snipe/snipe-it (snipe): 5.3.0snipe/snipe-it (Packagist): 5.3.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
grokabilitysnipe/snipe-itbefore 5.3.05.3.0Patch availableCNA
—snipe/snipe-it (Packagist)before 5.3.05.3.0Patch availableGHSA-g92x-8m54-p89v
  • snipe/snipe-it Vendorgrokability Affected before 5.3.0 Fixed in 5.3.0 Patch available CNA
  • snipe/snipe-it (Packagist) Vendor— Affected before 5.3.0 Fixed in 5.3.0 Patch available GHSA-g92x-8m54-p89v

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*before 5.3.0Vulnerablegrokability
  • cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* Versions before 5.3.0 Vulnerable ·grokability

Remediation

  • Fix · CNA snipe/snipe-it (snipe) Fixed in 5.3.0
  • Fix · GHSA-g92x-8m54-p89v snipe/snipe-it (Packagist) Fixed in 5.3.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    snipe/snipe-it 5.3.0

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2021-02794 Cross-site Scripting (XSS) - Generic in snipe/snipe-itPriority LOW 29
    • TI-2021-02802 Cross-site Scripting (XSS) - Stored in snipe/snipe-itPriority LOW 26
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3858
  2. 2026-10-03 Alias added: GHSA-g92x-8m54-p89v

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2026-45238 Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API CVSS 3.1HIGH 8.7
  • TI-2026-59327 Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation CVSS 4.0HIGH 8.6
  • TI-2026-44513 Snipe-IT: Stored XSS via Custom Field name in asset-list column headers CVSS 3.1HIGH 8.4
  • TI-2023-05072 Cross-Site Request Forgery (CSRF) in snipe/snipe-it CVSS 3.1HIGH 8.8
  • TI-2026-59308 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown CVSS 4.0HIGH 8.4
  • TI-2026-59298 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA CVSS 4.0HIGH 8.4
See all 134 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences