The vulnerability occurs in the user edit flow of Snipe-IT, where the web application stores the HTTP Referer header value in Laravel’s intended URL session variable. When a user later submits the form with redirect_option=back, the framework performs redirect()->intended, sending the user to the previously stored URL. If an attacker can influence the Referer header of an authenticated user’s request, they can cause the application to redirect that user to any site of the attacker’s choosing, enabling phishing or malicious site navigation. This flaw is classified as CWE‑601, Open Redirect.

It affects the Snipe‑IT asset and license management system produced by grokability. All releases before version 8.6.2 are vulnerable because the described redirect logic is present in those builds. The fix was introduced in the 8.6.2 release, so any deployment should be considered at risk.

The CVSS base score of 6.1 indicates medium severity. The EPSS score is less than 1 %, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that exploitation is not common. The likely attack vector is remote: an attacker must be able to set a crafted Referer header that will be seen by a legitimate user when editing a record, and then trick that user into submitting the form with redirect_option=back, causing the user to be directed to the attacker‑controlled URL. No publicly available exploit code is documented for this vulnerability.