{"id":"CVE-2026-114064","kind":"vulnerability","aliases":["CVE-2026-114064"],"related":[],"title":"Snipe-IT: webhook test feature lets super-admins probe internal network hosts","description":"Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows super-admin users to probe internal network addresses, including loopback and RFC1918 ranges. Attackers can point webhooks at internal hosts and ports, then compare 4xx versus 5xx responses from Test Webhooks to map open ports and active hosts.","summary":"Snipe-IT versions before 8.7.0 have a server-side request forgery flaw in the webhook test feature. A super-admin can point a webhook at loopback or private addresses and use the differing responses to map internal hosts and open ports.","severity":"medium","cvss":5.5,"epss":0.0027,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asset-management","other","self-hosted","snipe-it"],"not_affected_if":["no-super-admin-exposure","upgraded-to-8.7.0"],"how_to_check":"- Check the installed Snipe-IT version in the admin panel or the application's `.env`/release tag; versions below `8.7.0` are in scope.\n- Confirm whether the webhook test feature is used at all; the sources do not give a specific setting to disable it.","fix":"- Upgrade Snipe-IT to `8.7.0` or later.","status":"open","published_at":"2026-10-21T01:17:29+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T04:11:59+00:00","updated_at":"2026-10-25T04:11:59+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:11:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Snipe-IT to `8.7.0` or later.","reach":"internet","title":"Snipe-IT: webhook test feature lets super-admins probe internal network hosts","impact":"low","summary":"Snipe-IT versions before 8.7.0 have a server-side request forgery flaw in the webhook test feature. A super-admin can point a webhook at loopback or private addresses and use the differing responses to map internal hosts and open ports.","category":"other","nicknames":[],"who_cares":["snipe-it","self-hosted","asset-management"],"confidence":0.6,"needs_auth":"yes","worst_case":"Internal hosts and open ports are mapped from inside the network.","analyst_note":"","how_to_check":"- Check the installed Snipe-IT version in the admin panel or the application's `.env`/release tag; versions below `8.7.0` are in scope.\n- Confirm whether the webhook test feature is used at all; the sources do not give a specific setting to disable it.","needs_analyst":false,"not_affected_if":["upgraded-to-8.7.0","no-super-admin-exposure"],"who_is_affected":"Self-hosted or managed Snipe-IT instances before 8.7.0 where super-admin accounts exist. The attacker needs super-admin access, so instances with tightly held super-admin accounts face lower practical risk. Teams on 8.7.0 or later are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000599,"input_tokens":3387,"output_tokens":521,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114064':17A,20A '-2026':16A,19A '4xx':119C '5xx':121C '8.7.0':35B,78C 'activ':131C 'address':61B,102C 'admin':10A,52B,96C 'allow':93C 'asset':22B 'asset-manag':21B 'attack':108C 'compar':118C 'contain':79C 'cve':15A,18A 'differ':65B 'featur':6A,48B,91C 'flaw':43B 'forgeri':42B,85C 'host':14A,27B,70B,114C,132C 'includ':103C 'intern':12A,69B,100C,113C 'let':7A 'loopback':58B,104C 'manag':23B 'map':68B,127C 'network':13A,101C 'open':72B,128C 'point':54B,110C 'port':73B,116C,129C 'privat':60B 'probe':11A,99C 'rang':107C 'request':41B,84C 'respons':66B,122C 'rfc1918':106C 'self':26B 'self-host':25B 'server':39B,82C 'server-sid':38B,81C 'side':40B,83C 'snipe':2A,29B,31B,75C 'snipe-it':1A,28B,30B,74C 'super':9A,51B,95C 'super-admin':8A,50B,94C 'test':5A,47B,90C,124C 'use':63B 'user':97C 'version':33B 'versus':120C 'vulner':86C 'webhook':4A,46B,56B,89C,111C,125C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed Snipe-IT instances before 8.7.0 where super-admin accounts exist. The attacker needs super-admin access, so instances with tightly held super-admin accounts face lower practical risk. Teams on 8.7.0 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114064","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114064","severity":null,"published_at":"2026-10-21T01:17:29+00:00","modified_at":"2026-10-22T17:34:37+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114064","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114064","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}