Snipe-IT: Open redirect vulnerability
Priority LOW 30CWE-601Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-601.
Summary
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable. This vulnerability is fixed in 8.4.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00163 5th percentileScored 2026-11-07
Fix Fixed snipe-it (grokability): 8.4.1snipe/snipe-it (Packagist): 8.4.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| grokability | snipe-it | before 8.4.1 | 8.4.1 | Patch available | CNA |
| — | snipe/snipe-it (Packagist) | before 8.4.1 | 8.4.1 | Patch available | GHSA-mghp-5cq4-v6mg |
- snipe-it Vendorgrokability Affected before 8.4.1 Fixed in 8.4.1 Patch available CNA
- snipe/snipe-it (Packagist) Vendor— Affected before 8.4.1 Fixed in 8.4.1 Patch available GHSA-mghp-5cq4-v6mg
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* | before 8.4.1 | Vulnerable | grokability |
- cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* Versions before 8.4.1 Vulnerable ·grokability
Remediation
- Fix · CNA snipe-it (grokability) Fixed in 8.4.1
- Fix · GHSA-mghp-5cq4-v6mg snipe/snipe-it (Packagist) Fixed in 8.4.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-44833
- 2026-10-03 Alias added: GHSA-mghp-5cq4-v6mg
References
More grokability Snipe-it vulnerabilities
- TI-2026-45238 Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API CVSS 3.1HIGH 8.7
- TI-2026-59327 Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation CVSS 4.0HIGH 8.6
- TI-2026-44513 Snipe-IT: Stored XSS via Custom Field name in asset-list column headers CVSS 3.1HIGH 8.4
- TI-2023-05072 Cross-Site Request Forgery (CSRF) in snipe/snipe-it CVSS 3.1HIGH 8.8
- TI-2026-59308 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown CVSS 4.0HIGH 8.4
- TI-2026-59298 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA CVSS 4.0HIGH 8.4
Sources
- CVE-2026-44833 · CVE Program
- CVE-2026-44833 · NVD
- FIRST EPSS
- GHSA-mghp-5cq4-v6mg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences