CVE-2026-114064

EUVD-2026-107015
Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows super-admin users to probe internal network addresses, including loopback and RFC1918 ranges. Attackers can point webhooks at internal hosts and ports, then compare 4xx versus 5xx responses from Test Webhooks to map open ports and active hosts.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 18.12%
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/grokability/snipe-it/security/advisories/GHSA-wqfr-w9hp-c7v6
https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-ssrf-port-scanning-via-webhook-testing-endpoint