Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: grokability snipe-it 8.6.3 Clear all filters
TI-2026-80218 CVE-2026-116200 · GHSA-5j22-x9vm-7fm5

StartTLS downgrade in Snipe-IT exposes LDAP credentials

Priority LOW 35

Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00151 Published 2026-10-25 Fixed in 8.6.3 CWE-319
TI-2026-80217 CVE-2026-116199 · GHSA-9cjx-rmhj-qc37

Authentication bypass in Snipe-IT via Google SSO callback

Priority MEDIUM 41

Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00315 Published 2026-10-25 Fixed in 8.6.3 CWE-285