All vulnerabilities
CVE-2026-116200GHSA-wx48-r3qh-jvh5

Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()

grokability snipe-it
Open in ThreatlineRecord JSON
CVSS
8.2High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in8.6.3Fixed versionCVE List
Published25 Oct 2026Updated 25 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds. Attackers can answer the StartTLS request with a protocol error to capture service-account credentials and end-user login passwords.

Text from CVE List

Affected versions 2

  • snipe-itaffected: all versions before 8.6.3CVE List
  • snipe-itunaffected: 8.6.3CVE List

References 2