Snipe-IT CVE-2026-114064

Requires an authenticated super-admin account (CVSS PR:H) and access to the webhook testing feature (the 'Test Webhooks' function) in Snipe-IT before 8.7.0. The attacker must be able to set an arbitrary webhook target URL and observe the differential HTTP responses (4xx vs 5xx). Limiting factors: exploitation is gated behind the highest privilege level, so no unauthenticated or low-privilege attacker can trigger it; impact is confined to internal network reconnaissance rather than data exfiltration or code execution, and the fix in 8.7.0 removes the primitive.

This is a medium-severity, defense-in-depth issue rather than an urgent priority. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:L, score 5.1) is dominated by the PR:H requirement: exploitation requires an authenticated super-admin, the highest privilege tier in Snipe-IT. No EPSS score was supplied, the CVE is not on CISA KEV, and no public exploit code is referenced - so there are no signals of active or imminent widespread exploitation. The real-world impact is limited to internal reconnaissance (port/host mapping via 4xx vs 5xx response discrimination, consistent with CWE-203 observable discrepancy), not direct code execution or data theft. The key caveat: because the attacker must already be super-admin, this is primarily useful as a pivot/lateral-reconnaissance primitive by an already-trusted or compromised admin account, which substantially narrows the realistic threat. Signals are internally consistent (high privilege, low technical impact, no exploitation evidence), so there is no major conflict to flag; the main missing data points are EPSS and any POC status.

A super-admin account (either malicious insider or an attacker who has already phished/hijacked admin credentials) configures a webhook URL pointing at an internal address such as http://127.0.0.1:port or an RFC1918 host, then uses the Test Webhook feature repeatedly. By comparing 4xx versus 5xx responses, they enumerate which internal hosts and ports are live, mapping the internal network from the application server's vantage point. No public exploit code is referenced, so this would currently require manual, hands-on-keyboard abuse by a privileged user.