CVE-2026-44833

FAUCET Score

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable. This vulnerability is fixed in 8.4.1.

First published: May 26, 2026Last modified: May 26, 2026

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 8.4.1CPE matchmatch criteria	cpe:2.3:a:snipeitapp:snipe-it::::::::

CVSS Data

CVSS version used by this source: 3.1

5.9MEDIUM

CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

Exploitability Score

1.7

Impact Score

3.7

CvssVersion

3.1

Exploit Intelligence

EPSS Score

0.16%

Probability of exploitation in next 30 days

EPSS Percentile

5.9%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0016 is in the 4th percentile among its peer group of 14,875 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

composerpatch availablevia ghsa

Product: snipe/snipe-itFixed in: 8.4.1

github_advisorypatch availablevia nvd_reference

View patch

Vendor Advisories (1)

composerGHSA-mghp-5cq4-v6mgmedium

Snipe-IT has an open redirect vulnerability

May 8, 2026

References

github.com / grokability/snipe-it/commit/e37649212861a337e68a624e589c3540b7a82373

Patch

github.com / grokability/snipe-it/security/advisories/GHSA-mghp-5cq4-v6mg

PatchVendor Advisory