Snipe‑IT versions earlier than 8.7.0 contain a server‑side request forgery flaw in the webhook testing endpoint. When a super‑admin directs the system to send HTTP requests to arbitrary internal addresses, including loopback and RFC1918 ranges, the application leaks information by returning 4xx or 5xx response codes. This allows the attacker to map reachable hosts and open ports without deploying code on the target. Based on the description, it is inferred that the attacker must have super‑admin credentials to trigger the SSRF, so credential compromise or privileged access is the primary attack path. The vulnerability does not provide remote code execution or privilege escalation, but it exposes internal network topology, potentially aiding broader reconnaissance.

Groakability's Snipe‑IT application versions older than 8.7.0 are affected. The flaw resides in the webhook testing feature that is available exclusively to users with super‑admin rights.

With a CVSS score of 5.1, the flaw is considered moderate. The EPSS score of less than 1% indicates a low likelihood that it will be exploited in the wild. The vulnerability is not listed in the CISA KEV catalog, underscoring its relatively lower threat level. However, because the attack requires only a super‑admin account, any compromise of privileged credentials could allow internal network probing. Attackers can trigger the SSRF remotely after authentication, directing the application to target internal IP ranges and ports. Detection is therefore limited to observing abnormal outbound traffic or 4xx vs 5xx response patterns, as the vulnerability does not lead to code execution.