CVE-2026-44833
Published:May 26, 2026
Updated:June 11, 2026
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable. This vulnerability is fixed in 8.4.1.
Affected Packages
https://github.com/grokability/snipe-it.git (GITHUB):
Affected version(s) >=v0.1.0 <v8.4.1Fix Suggestion:
Update to version v8.4.1snipe/snipe-it (PHP):
Affected version(s) >=dev-+more-table-components <v8.4.1Fix Suggestion:
Update to version v8.4.1Related Resources (4)
Do you need more information?
Contact UsCVSS v4
Base Score:
2.4
Attack Vector
ADJACENT
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
PASSIVE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
LOW
Subsequent System Confidentiality
LOW
Subsequent System Integrity
LOW
Subsequent System Availability
LOW
CVSS v3
Base Score:
5.9
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
LOW
Weakness Type (CWE)
URL Redirection to Untrusted Site ('Open Redirect')
EPSS
Base Score:
0.01