CVE-2026-44833 PUBLISHED

Snipe-IT: Open redirect vulnerability

Assigner: GitHub_M
Reserved: 07.05.2026 Published: 26.05.2026 Updated: 27.05.2026

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable. This vulnerability is fixed in 8.4.1.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
CVSS Score: 5.9

Attack Vector	Adjacent Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	Low	Integrity Impact	Low
User Interaction	Required	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	grokability
Product	snipe-it
Versions	Version < 8.4.1 is affected

References

https://github.com/grokability/snipe-it/security/advisories/GHSA-mghp-5cq4-v6mg
https://github.com/grokability/snipe-it/commit/e37649212861a337e68a624e589c3540b7a82373

Problem Types

CWE-601: URL Redirection to Untrusted Site ('Open Redirect') CWE