EUVD-2026-42999
GHSA-wg2f-x2c2-c4rp
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AV:N/AC:L as attack is network-delivered with no special conditions; PR:N because the attacker needs no Snipe-IT account; UI:R and S:C capture mandatory victim interaction and cross-origin redirect impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url()->previous() from the attacker-controlled Referer header into Laravel’s intended URL session value and later uses redirect()->intended(...) when redirect_option=back is submitted, allowing Snipe-IT to be used as a trusted redirector after a legitimate user edit action. This issue is fixed in version 8.6.2.
AnalysisAI
Open redirect in Snipe-IT prior to 8.6.2 allows unauthenticated attackers to abuse the application as a trusted redirector against authenticated users. The user edit workflow persists the HTTP Referer header - which an attacker can control - into Laravel's session-stored intended URL, then unconditionally honors it via redirect()->intended() when redirect_option=back is submitted by a legitimate user. No public exploit code and no CISA KEV listing have been identified at time of analysis; the vulnerability is a medium-severity phishing-chain enabler rather than a direct system compromise.
Technical ContextAI
Snipe-IT is a Laravel-based PHP web application for IT asset and license management. The flaw is rooted in CWE-601 (URL Redirection to Untrusted Site). Laravel's url()->previous() method reads the HTTP Referer header to infer the prior navigation URL, and the framework's redirect()->intended() method consumes a session-stored URL to redirect the user after completing an action. In the affected user edit code path, the Referer value is written into the Laravel session as the 'intended' destination without any origin validation or allowlisting. When a form submission includes redirect_option=back, the application faithfully issues a 302 redirect to the attacker-supplied URL stored in session. The fix is confirmed in commit f4cac9635868c020174361ad7a80b2545a4e7623, which presumably validates or discards the Referer-derived URL before storing it.
RemediationAI
Upgrade Snipe-IT to version 8.6.2 or later; this is the vendor-released patch per the GitHub release at https://github.com/grokability/snipe-it/releases/tag/v8.6.2 and the fix commit f4cac9635868c020174361ad7a80b2545a4e7623. If immediate upgrade is not feasible, operators can configure a reverse proxy or WAF rule to strip or validate the Referer header on requests to the user edit endpoint, preventing the attacker-controlled value from reaching Laravel's url()->previous() call - note this may break legitimate back-navigation UX for users. Alternatively, restricting access to Snipe-IT's user edit functionality to trusted internal network segments reduces exposure, but does not eliminate risk from insider or socially engineered sessions. None of these compensating controls are a substitute for patching to 8.6.2.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today