Vulnerability · Published Jul 10, 2026 · Assigned by GitHub_M

CVE-2026-55461Snipe-IT: Open Redirect After User Edit

Medium 6.1

In plain English

A medium-severity open redirect in snipe-it from grokability. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.3%top 76.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url()->previous() from the attacker-controlled Referer header into Laravel’s intended URL session value and later uses redirect()->intended(...) when redirect_option=back is submitted, allowing Snipe-IT to be used as a trusted redirector after a legitimate user edit action. This issue is fixed in version 8.6.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	snipe/snipe-it	8.6.2	GHSA-wg2f-x2c2-c4rp

Affected products (as reported)

Vendor	Product	Versions
grokability	snipe-it	< 8.6.2

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/grokability/snipe-it/security/advisories/GHSA-wg2f-x2c2-c4rp x_refsource_CONFIRM
https://github.com/grokability/snipe-it/commit/f4cac9635868c020174361ad7a80b2545a4e7623 x_refsource_MISC
https://github.com/grokability/snipe-it/releases/tag/v8.6.2 x_refsource_MISC