# CVE-2026-55461: Grokability Snipe-IT open redirect in user edit flow

Source: https://junglewise.ai/threats/cve-2026-55461-grokability-snipe-it-open-redirect-in-user-edit-flow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-55461 · Severity: medium · CVSS 6.1 · Published 2026-07-10

Snipe-IT is an asset management platform used to track IT equipment and inventory. An authenticated user with permission to edit user records can be redirected to an attacker-controlled external website after completing a normal user-edit action. An attacker can exploit this by sending a logged-in user a malicious link to the user-edit page, causing them to be redirected to a phishing site or other malicious destination after saving their changes, potentially compromising user credentials or trust in the application.

Technologies: [snipe/snipe-it (Packagist)](https://junglewise.ai/threats/technologies/snipe-snipe-it). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-55461 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55461 being exploited in the wild.

**How severe is CVE-2026-55461?** Medium severity, with a CVSS score of 6.1, published 10 July 2026.

**Which products and versions are affected?** snipe/snipe-it (Packagist) <= 8.6.1, ECOSYSTEM:introduced=0,fixed=8.6.2.

**Is there a fix for CVE-2026-55461?** Yes. snipe/snipe-it (Packagist): upgrade to 8.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55461 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55461?** Check whether you run snipe/snipe-it (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- snipe/snipe-it (Packagist): upgrade to 8.6.2 or later

  ```sh
  composer require snipe/snipe-it:^8.6.2
  ```


## Technical details

This is an open redirect vulnerability (CWE-601) in Snipe-IT's user edit flow. The vulnerable code stores the attacker-controlled Referer HTTP header into Laravel's session-based intended URL using `url()->previous()`, then later redirects to that stored URL when the user submits the form with `redirect_option=back` via `redirect()->intended(...)`. Because the Referer header is derived from user input, an attacker can craft a URL with a malicious Referer header pointing to an external site. An authenticated user with user-edit permissions is the target. When such a user completes a legitimate user edit action, they are transparently redirected to the attacker-controlled destination, which can be used for phishing or social engineering attacks. The vulnerability was patched in version 8.6.2 (commit f4cac96358). Affected versions are Snipe-IT 8.6.1 and earlier.

## Affected products

- Snipe IT Snipe-IT <= 8.6.1

## Identifiers

- CVE-2026-55461
- GHSA-wg2f-x2c2-c4rp

## Timeline

- 2026-06-24: disclosed: Published in GitHub Advisory Database (initial advisory date)
- 2026-08-28: advisory: Updated in GitHub Advisory Database
- 2026-06-24: patched: Patched in version 8.6.2 (commit f4cac96358)

## References

- [https://api.github.com/users/mamdouhmahfouz](https://api.github.com/users/mamdouhmahfouz)
- [https://github.com/mamdouhmahfouz](https://github.com/mamdouhmahfouz)
- [https://api.github.com/users/mamdouhmahfouz/gists%7B/gist_id%7D](https://api.github.com/users/mamdouhmahfouz/gists%7B/gist_id%7D)
- [https://api.github.com/users/mamdouhmahfouz/repos](https://api.github.com/users/mamdouhmahfouz/repos)
- [https://avatars.githubusercontent.com/u/127619974?v=4](https://avatars.githubusercontent.com/u/127619974?v=4)
- [https://api.github.com/users/mamdouhmahfouz/events%7B/privacy%7D](https://api.github.com/users/mamdouhmahfouz/events%7B/privacy%7D)

## Related threats

- [Snipe-IT stored XSS via inline XML rendering in uploaded files API](https://junglewise.ai/threats/cve-2026-63498-snipe-it-stored-xss-via-inline-xml-rendering-in-uploaded-files)
- [Snipe-IT 2FA bypass via API token flow](https://junglewise.ai/threats/cve-2026-63493-snipe-it-2fa-bypass-via-api-token-flow)
- [Snipe-IT stored XSS in custom field names](https://junglewise.ai/threats/cve-2026-62368-snipe-it-stored-xss-in-custom-field-names)
- [Snipe-IT stored DOM XSS via table selected-count IDs](https://junglewise.ai/threats/cve-2026-61807-snipe-it-stored-dom-xss-via-table-selected-count-ids)
- [Snipe-IT maintenance record disclosure via missing authorization](https://junglewise.ai/threats/cve-2026-55703-snipe-it-maintenance-record-disclosure-via-missing-authorization)