CVE-2026-86735Medium· 5.0▾ Sunlitsnipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect IPv6 transition addresses encoding private IPv4 targets. Attackers with super-admin privileges can…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.3%
snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect IPv6 transition addresses encoding private IPv4 targets. Attackers with super-admin privileges can configure webhook URLs using NAT64, 6to4, or Teredo transition addresses to bypass SSRF guards and access internal services or cloud metadata endpoints.
snipe-it < 8.7.0Upgrade past the affected range:
snipe-it 8.7.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-86771High· 7.6Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML() function
CVE-2026-116200Medium· 5.9Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()
CVE-2026-116198Medium· 4.3Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store
CVE-2026-116199High· 8.1Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback
CVE-2026-116201High· 8.8Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition
CVE-2026-114064Medium· 5.5Snipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing Endpoint