Snipe-IT CVE-2026-55461

Exploitation requires three concurrent conditions: first, a legitimate Snipe-IT user must be authenticated (they must have a valid session to access the user edit workflow); second, that user must be induced to navigate to the Snipe-IT user edit page via a link or redirect originating from an attacker-controlled page, causing the browser to populate the Referer header with the attacker's URL; third, the victim must submit the user edit form with the redirect_option=back parameter present. Exploitation is bounded by the mandatory user interaction (UI:R) - the attacker cannot trigger the redirect unilaterally. The attack does not require any non-default Snipe-IT server-side configuration; it affects default installations prior to 8.6.2. The attacker requires no Snipe-IT account or privileges (PR:N), but does require the victim to hold an active, authenticated session.

The CVSS 3.1 score of 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N accurately reflects the real-world risk profile. The scope change (S:C) captures the redirect's cross-origin nature, and UI:R correctly constrains exploitability - the victim must actively complete a user edit action, limiting opportunistic or automated mass exploitation. This is not a remotely triggerable flaw; it sits in a phishing-chain role where the legitimate Snipe-IT domain lends credibility to the redirect destination. No EPSS probability was provided in the intelligence, making quantitative exploitation likelihood comparison impossible. There is no CISA KEV listing and no known POC, consistent with targeted rather than widespread exploitation. The absence of confidentiality or integrity impact on the Snipe-IT system itself means the primary risk is credential harvesting or social engineering at the destination site - meaningful in high-value enterprise environments but not an urgent remote-code-execution-class priority.

An attacker hosts a page that issues a redirect to Snipe-IT's user edit URL, causing the victim's browser to send the attacker's domain in the Referer header. When the authenticated Snipe-IT user completes the edit form (which includes redirect_option=back), the application redirects them to the attacker's site - where a spoofed Snipe-IT login page can harvest credentials. No public POC code has been identified; the attack requires only standard browser HTTP behavior and social engineering to lure the victim to the attacker-controlled initial page.