5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44833

CVE-2026-44833: Snipe-IT: Open redirect vulnerability

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable. This vulnerability is fixed in 8.4.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44833

CVE-2026-44833:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
snipe/snipe-it	composer	< 8.4.1	8.4.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an open redirect in Snipe-IT, caused by the application's unsafe handling of user redirection based on the HTTP Referer header. The core of the vulnerability lies in the App\Helpers\Helper::getRedirectOption function, which retrieves a URL from a session variable (back_url) and performs a redirect without validating that the URL is internal to the application. This allows an attacker to redirect users to malicious websites.

The vulnerability is triggered in a two-step process:

Session Poisoning: An attacker tricks a user into clicking a link that directs them to an edit page within Snipe-IT (e.g., for an asset, accessory, or user). This request is crafted to have a malicious Referer header. The edit methods in various controllers (e.g., AccessoriesController, AssetsController, UsersController) capture this Referer URL via url()->previous() and store it in the back_url session variable.
Redirection: After the user submits a form on the edit page (e.g., by clicking 'Save'), the application calls the App\Helpers\Helper::getRedirectOption function. If the user has selected to be redirected 'back', this function reads the poisoned URL from the session and uses redirect()->to() to redirect the user to the attacker's site.

The patch addresses this by replacing the unsafe redirect()->to() with Laravel's redirect()->intended(), which is designed to handle this type of redirection safely by ensuring the redirect target is a local URL. Additionally, the session key was changed from back_url to url.intended to align with Laravel's conventions.

Vulnerable functions

App\Helpers\Helper::getRedirectOption

app/Helpers/Helper.php

This function is vulnerable to an open redirect. It retrieves a URL from the session variable 'back_url' and redirects the user to it without any validation. An attacker can poison this session variable by controlling the HTTP Referer header, leading to redirection to a malicious site. The patch replaces the unsafe `redirect()->to()` with `redirect()->intended()`, which is designed to prevent such attacks.

App\Http\Controllers\Accessories\AccessoriesController::edit

app/Http/Controllers/Accessories/AccessoriesController.php

This function contributes to the open redirect vulnerability by storing the URL from the HTTP Referer header into the 'back_url' session variable. This happens when a user visits the edit page for an accessory. The stored URL is later used by `App\Helpers\Helper::getRedirectOption` to perform the redirect. An attacker can craft a link that causes a malicious URL to be stored in the session.

App\Http\Controllers\Assets\AssetsController::edit

app/Http/Controllers/Assets/AssetsController.php

This function contributes to the open redirect vulnerability by storing the URL from the HTTP Referer header into the 'back_url' session variable when a user edits an asset. This unvalidated URL is then used for redirection, allowing an attacker to lead users to malicious websites.

App\Http\Controllers\Components\ComponentsController::edit

app/Http/Controllers/Components/ComponentsController.php

This function contributes to the open redirect vulnerability by storing the URL from the HTTP Referer header into the 'back_url' session variable when a user edits a component. This unvalidated URL is then used for redirection, allowing an attacker to lead users to malicious websites.

App\Http\Controllers\Consumables\ConsumablesController::edit

app/Http/Controllers/Consumables/ConsumablesController.php

This function contributes to the open redirect vulnerability by storing the URL from the HTTP Referer header into the 'back_url' session variable when a user edits a consumable. This unvalidated URL is then used for redirection, allowing an attacker to lead users to malicious websites.

App\Http\Controllers\Licenses\LicensesController::edit

app/Http/Controllers/Licenses/LicensesController.php

This function contributes to the open redirect vulnerability by storing the URL from the HTTP Referer header into the 'back_url' session variable when a user edits a license. This unvalidated URL is then used for redirection, allowing an attacker to lead users to malicious websites.

App\Http\Controllers\Users\UsersController::edit

app/Http/Controllers/Users/UsersController.php

This function contributes to the open redirect vulnerability by storing the URL from the HTTP Referer header into the 'back_url' session variable when a user edits a user profile. This unvalidated URL is then used for redirection, allowing an attacker to lead users to malicious websites.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.