CVE-2026-55461: Snipe-IT CSRF Vulnerability

CVE-2026-55461 Overview

CVE-2026-55461 is an open redirect vulnerability [CWE-601] in Snipe-IT, an open-source IT asset and license management system maintained by Grokability. Versions prior to 8.6.2 store the value of url()->previous() — derived from the attacker-controlled Referer header — into Laravel's intended URL session key during the user edit flow. When a request submits redirect_option=back, the application calls redirect()->intended(...) and forwards the authenticated user to the attacker-supplied destination. This turns Snipe-IT into a trusted redirector that can be abused for phishing and credential theft campaigns that leverage the target organization's domain reputation.

Critical Impact
Authenticated user edit actions can be leveraged to redirect legitimate users to attacker-controlled URLs, enabling phishing and social engineering attacks that abuse the trust of the Snipe-IT domain.

Affected Products

Snipe-IT versions prior to 8.6.2
Grokability Snipe-IT self-hosted deployments
Snipe-IT instances exposing the user edit flow to authenticated users

Discovery Timeline

2026-07-10 - CVE-2026-55461 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-55461

Vulnerability Analysis

The flaw resides in the Snipe-IT user edit workflow implemented in UsersController. During the initial GET request to the edit page, the application captures the incoming Referer header via Laravel's url()->previous() helper and stores it in the session under the url.intended key. The Referer header is fully controllable by whoever initiates the navigation, including a remote attacker who lures a signed-in Snipe-IT user to click a crafted link.

When the user later submits the edit form with the parameter redirect_option=back, the controller invokes redirect()->intended(...). Laravel reads the previously stored url.intended value and issues an HTTP redirect to that destination without validating that the URL belongs to the Snipe-IT origin. The result is a same-origin open redirect that requires only a single legitimate form submission by the victim.

Root Cause

The root cause is unvalidated trust in an external, user-supplied header. Laravel's intended() helper is designed to return users to a previously requested internal route, but the Snipe-IT flow populated that value from the raw Referer string. No allowlist, origin comparison, or host normalization was applied before persisting the value or performing the redirect.

Attack Vector

An attacker crafts a page or email that navigates a signed-in Snipe-IT user to the user edit route with a Referer header pointing to an attacker-controlled site. The victim completes a legitimate edit action, submits the form with redirect_option=back, and Snipe-IT redirects the browser to the external domain. That destination can host a cloned Snipe-IT login page to harvest re-authentication credentials or deliver malware.

php

// Patch reference: app/Http/Controllers/Users/UsersController.php
// and app/Models/User.php
// Source: https://github.com/grokability/snipe-it/commit/f4cac9635868c020174361ad7a80b2545a4e7623

public function scopeWithInventoryRelations(
    $query,
    int $id,
    bool $withLicenses = true,
    bool $withAccessories = true,
    bool $withConsumables = true
) {
    $with = [
        'assets.log' => fn ($query) => $query->withTrashed()
            ->where('target_type', User::class)
            ->where('target_id', $id)
            ->where('action_type', 'accepted'),
        // ... additional scoped relations
    ];
}

Source: Grokability Snipe-IT commit f4cac96

Detection Methods for CVE-2026-55461

Indicators of Compromise

HTTP 302 responses from /users/{id}/edit submissions with Location headers pointing to external domains.
Inbound requests to the user edit route containing Referer headers with hosts outside the organization's Snipe-IT domain.
Form submissions carrying the parameter redirect_option=back followed by cross-origin redirects.

Detection Strategies

Parse Snipe-IT web server access logs and correlate Referer values against the deployed Snipe-IT hostname to surface cross-origin referrers on edit routes.
Inspect application logs for redirect()->intended(...) responses whose target host does not match the configured APP_URL.
Deploy a web application firewall rule that blocks or flags requests to user edit endpoints when the Referer header host is not on an allowlist.

Monitoring Recommendations

Alert on unusual outbound redirects originating from authenticated Snipe-IT sessions in reverse proxy or CDN logs.
Track user reports of unexpected redirects following legitimate edits, which often indicate active phishing campaigns.
Monitor authentication events for repeated re-login attempts shortly after edit actions, which may signal credential-harvesting attempts downstream.

How to Mitigate CVE-2026-55461

Immediate Actions Required

Upgrade all Snipe-IT installations to version 8.6.2 or later, which contains the vendor fix.
Restrict access to Snipe-IT to trusted networks or behind SSO with anti-phishing controls until patching is complete.
Communicate to users that they should not click Snipe-IT links from untrusted sources during the exposure window.

Patch Information

The fix is included in Snipe-IT v8.6.2. Details are published in the GitHub Security Advisory GHSA-wg2f-x2c2-c4rp and the v8.6.2 release notes. The code change is documented in the upstream commit f4cac96.

Workarounds

Configure a reverse proxy or WAF to strip or validate the Referer header for requests to /users/*/edit endpoints.
Block outbound redirects from Snipe-IT to hosts outside the organization's controlled domains at the proxy layer.
Disable or restrict the redirect_option=back submission parameter through server-side rewrite rules if upgrade cannot be performed immediately.

bash

# Upgrade Snipe-IT to the patched release
cd /var/www/snipe-it
sudo -u www-data git fetch --tags
sudo -u www-data git checkout v8.6.2
sudo -u www-data composer install --no-dev --prefer-source
sudo -u www-data php artisan migrate --force
sudo -u www-data php artisan config:clear
sudo -u www-data php artisan cache:clear
sudo systemctl reload php-fpm nginx