LDAP Downgrade Vulnerability in Snipe-IT by Grokability
CVE-2026-116200

8.2HIGH

Key Information:

Vendor

Grokability

Status
Snipe-it
Vendor
CVE Published:
25 October 2026

What is CVE-2026-116200?

Snipe-IT versions prior to 8.6.3 have a vulnerability in their LDAP handling which fails to properly manage the return value of the ldap_start_tls() function in Ldap::connectToLdap(). This oversight allows potential attackers to manipulate the StartTLS request, resulting in the ability to force cleartext LDAP binds. As a consequence, sensitive information such as service-account credentials and end-user login passwords can be intercepted by attackers during the connection process. It is advisable for users to upgrade to the latest version to safeguard against this vulnerability.

Affected Version(s)

snipe-it 0 < 8.6.3

snipe-it 8.6.3

References

https://github.com/grokability/snipe-it/security/advisori...
vendor-advisory
https://www.vulncheck.com/advisories/snipe-it-before-8.6....
third-party-advisory

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

builtbybrayden
snipe
.