CVE-2026-55461: Grokability Snipe-IT open redirect in user edit flow

CVE-2026-55461 · Severity: medium · CVSS 6.1 · Published 2026-07-10

Snipe-IT is an asset management platform used to track IT equipment and inventory. An authenticated user with permission to edit user records can be redirected to an attacker-controlled external website after completing a normal user-edit action. An attacker can exploit this by sending a logged-in user a malicious link to the user-edit page, causing them to be redirected to a phishing site or other malicious destination after saving their changes, potentially compromising user credentials or trust in the application.

Technologies: snipe/snipe-it (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-55461 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55461 being exploited in the wild.
How severe is CVE-2026-55461?
Medium severity, with a CVSS score of 6.1, published 10 July 2026.
Which products and versions are affected?
snipe/snipe-it (Packagist) <= 8.6.1, ECOSYSTEM:introduced=0,fixed=8.6.2.
Is there a fix for CVE-2026-55461?
Yes. snipe/snipe-it (Packagist): upgrade to 8.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55461 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-55461?
Check whether you run snipe/snipe-it (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • snipe/snipe-it (Packagist): upgrade to 8.6.2 or later
    composer require snipe/snipe-it:^8.6.2

Technical details

This is an open redirect vulnerability (CWE-601) in Snipe-IT's user edit flow. The vulnerable code stores the attacker-controlled Referer HTTP header into Laravel's session-based intended URL using `url()->previous()`, then later redirects to that stored URL when the user submits the form with `redirect_option=back` via `redirect()->intended(...)`. Because the Referer header is derived from user input, an attacker can craft a URL with a malicious Referer header pointing to an external site. An authenticated user with user-edit permissions is the target. When such a user completes a legitimate user edit action, they are transparently redirected to the attacker-controlled destination, which can be used for phishing or social engineering attacks. The vulnerability was patched in version 8.6.2 (commit f4cac96358). Affected versions are Snipe-IT 8.6.1 and earlier.

Affected products

  • Snipe IT Snipe-IT <= 8.6.1

Identifiers

  • CVE-2026-55461
  • GHSA-wg2f-x2c2-c4rp

Timeline

  • 2026-06-24: disclosed: Published in GitHub Advisory Database (initial advisory date)
  • 2026-08-28: advisory: Updated in GitHub Advisory Database
  • 2026-06-24: patched: Patched in version 8.6.2 (commit f4cac96358)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.