CVE-2026-44833: Snipe-IT has an open redirect vulnerability

May 8, 2026 (updated June 8, 2026)

Open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable.

References

github.com/advisories/GHSA-mghp-5cq4-v6mg
github.com/grokability/snipe-it/commit/e37649212861a337e68a624e589c3540b7a82373
github.com/grokability/snipe-it/security/advisories/GHSA-mghp-5cq4-v6mg
nvd.nist.gov/vuln/detail/CVE-2026-44833

Code Behaviors & Features

Detect and mitigate CVE-2026-44833 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →