CVE-2026-114064

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0

Description A server-side request forgery (SSRF) issue exists in the webhook testing feature. This allows super-admin users to probe internal network addresses, including loopback and RFC1918 ranges (private IP address spaces). By pointing webhooks at internal hosts and ports and comparing 4xx versus 5xx responses from the Test Webhooks functionality, an attacker can map active hosts and open ports.

Recommendations Update to version 8.7.0 or later.