The vulnerability allows attackers to forge or manipulate HTTP Referer headers that are saved into a session variable and later used for redirection. Because the input is not validated, an attacker can cause a legitimate user of the Snipe‑IT application to be redirected to a malicious website. This creates opportunities for phishing, social engineering, or malware delivery. The weakness is classified as CWE‑601.

Affected instances are deployments of the Snipe‑IT asset management system manufactured by grokability that are running any version before 8.4.1. The issue is present in all releases up to that point, as the fix was introduced in 8.4.1. Users of earlier releases have the vulnerability until they apply the update.

The CVSS score of 5.9 denotes moderate severity. The EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to influence the Referer header that the application later trusts, which can be done by delivering a crafted link or by instructing a collaborator to visit a malicious site. Because the attack vector is client‑side and does not require local privileges, a broad range of users could be affected if the application is exposed to the internet, making this a notable risk for exposed deployments.