CVE-2026-55461

Katalog CVE

CVSS 6.1 · Medium EPSS 0,31%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect') pada snipeitapp snipe-it. Skor CVSS 3.1 6.1 (Medium) menurut github.com.

Deskripsi (NVD)

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url()->previous() from the attacker-controlled Referer header into Laravel’s intended URL session value and later uses redirect()->intended(...) when redirect_option=back is submitted, allowing Snipe-IT to be used as a trusted redirector after a legitimate user edit action. This issue is fixed in version 8.6.2.

Rincian

Terbit di NVD

10 Juli 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 22,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/grokability/snipe-it/security/advisories/GHSA-wg2f-x2c2-c4rp patch · advisory vendor
• https://github.com/grokability/snipe-it/commit/f4cac9635868c020174361ad7a80b2545a4e7623 patch
• https://github.com/grokability/snipe-it/releases/tag/v8.6.2 release notes