Live › vulnerability › CVE-2026-116199
Go to dashboardSnipe-IT versions before 8.6.3 log in any user whose username matches a Google account email without checking the activated flag. A deactivated user with a live Google identity can sign in again and regain their previous permissions, including admin.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Self-hosted Snipe-IT instances below 8.6.3 that have Google SSO enabled and contain deactivated users whose usernames are email addresses. Instances without Google SSO, or where all usernames are not email-shaped, are less exposed according to the description.
No product ranges from the sources yet.
php artisan --version or the About page) and confirm whether it is below 8.6.38.6.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can sign in via Google SSO and regain sessions at their original permission level, including admin.
This page as .md · .json · in your agent: get_signal("CVE-2026-116199")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.