Snipe-IT CVE-2026-116199

Exploitation requires all of: (1) Google SSO is enabled on the Snipe-IT instance; (2) the deployment uses email-as-username, or the targeted account specifically has an email-shaped username, so that User::where('username', googleEmail) returns a row; (3) the targeted account has been deactivated in Snipe-IT (activated=0); and (4) the attacker still controls the matching, unrevoked Google Workspace identity. Limiting factors: default Snipe-IT installations use the firstname.lastname username format, where the username/email mismatch makes the lookup return NULL and the instance is NOT affected even with Google SSO enabled; the attacker must possess valid live Google credentials for an identity matching an existing (deactivated) Snipe-IT username, making this primarily an offboarding-window / former-insider threat rather than anonymous external compromise.

This is a genuine high-priority issue, but its real-world reach is gated by specific deployment preconditions rather than being a universal remote compromise. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 9.2 and correctly uses AT:P (attack requirements present) to signal that exploitation is network-reachable and procedurally simple but depends on non-default conditions - not a point-and-click flaw against every instance. The vuln.today Decision label is act_now and the report originates from VulnCheck, both reinforcing urgency for affected deployments. There is no CISA KEV listing and no EPSS value in the provided data, so there is no evidence of widespread automated exploitation; the GHSA advisory and VulnCheck advisory are analytical write-ups, not published working exploit code. The conflicting signal to weigh is PR:N versus the practical prerequisite that the attacker already be a (now-deactivated) legitimate user holding a still-live Google identity - the CVSS correctly rates privileges on the Snipe-IT system as none, but this is realistically an insider/offboarding-window threat rather than an anonymous external one. Net: a real priority for organizations running Google SSO with email-as-username, and a near-non-issue for default installations.

An employee is offboarded and their Snipe-IT account is deactivated (activated=0), but their Google Workspace account has not yet been disabled. Because the Snipe-IT instance uses email-as-username and the Google callback never checked the activated flag, the former employee signs in through Google SSO and is handed an authenticated session at their prior permission tier - including admin if they held it. No public working exploit code is identified; the GHSA advisory documents the exact vulnerable lookup and fix.