Snipe-IT, an IT asset/license management system by grokability, contains an open redirect vulnerability identified as CVE-2026-44833. In versions before 8.4.1, the application improperly validates the HTTP Referer header, which is stored in a session variable. This allows an attacker with low privileges and requiring user interaction to redirect users to untrusted external sites, potentially facilitating phishing or other malicious activities. The vulnerability is resolved in version 8.4.1.

Successful exploitation can lead to users being redirected to malicious websites, which may result in phishing attacks or other social engineering risks. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector (C:L/I:L/A:L). No known active exploits have been reported.

Upgrade Snipe-IT to version 8.4.1 or later, where this open redirect vulnerability has been fixed. Since the vendor advisory confirms the fix in 8.4.1, applying this update is the recommended remediation. No additional vendor advisories or temporary mitigations are provided.