Grokability Snipe-IT 8.5.0/8.6.3 Saml Controller /saml/acs SamlController::acs RelayState redirect

Summaryinfo

A vulnerability identified as problematic has been detected in Grokability Snipe-IT 8.5.0/8.6.3. Affected by this vulnerability is the function SamlController::acs of the file /saml/acs of the component Saml Controller. The manipulation of the argument RelayState leads to redirect. This vulnerability is listed as CVE-2026-86756. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Grokability Snipe-IT 8.5.0/8.6.3. This issue affects the function SamlController::acs of the file /saml/acs of the component Saml Controller. The manipulation of the argument RelayState with an unknown input leads to a redirect vulnerability. Using CWE to declare the problem leads to CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. Impacted is integrity. The summary by CVE is:

Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint (SamlController::acs, POST /saml/acs). The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key with only CR/LF characters stripped, and LoginController later issued redirect()->intended(), which passes an absolute URL through to the Location header unchanged. An unauthenticated attacker who induces a user of a SAML-SSO-enabled instance to visit a crafted IdP-initiated SSO link can therefore cause the victim's browser to be redirected to an arbitrary absolute external URL immediately after a successful authentication, which the advisory notes facilitates credential-harvesting phishing. No account on the target instance and no compromise of the identity provider are required. Only deployments with SAML SSO enabled are affected. Fixed in 8.7.0 (commit d30b73d, PR #19386), which validates RelayState via a new Helper::sameOriginUrl check before storing it.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-86756 since 09/08/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1204.001 for this issue.

Upgrading to version 8.7.0 eliminates this vulnerability. Applying the patch d30b73d/19386 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Grokability

Name

• Snipe-IT

Version

• 8.5.0
• 8.6.3

Website

• Product: https://github.com/grokability/snipe-it/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion