CVE-2025-47226
3.3
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability: 1.8 / Impact: 1.4
Source: NVD
Description
Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.
Affected (1)
Products: Snipeitapp: Snipe It
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Before 8.1.0 |
Related CWEs
CWE-425
Direct Request ('Forced Browsing')
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
CWE-639
Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
References (4)
Source: cve@mitre.org
ExploitPatchThird Party Advisory
Timeline
No history available yet.