What is CVE-2026-116199?

CVE-2026-116199 is a high-severity vulnerability in Grokability Snipe-It, classified under Improper Authorization. CVSS score: 8.1/10. Published 2026-10-25.

How severe is CVE-2026-116199?

High severity. CVSS v3 base score is 8.1 out of 10.

Auth bypass in Grokability Snipe-It

CVE-2026-116199

Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can sign in via Google SSO and regain sessions at their original permission level, including admin.

Published 2026-10-25.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Grokability Snipe-It

Weakness classification (CWE)

CWE-285 — Improper Authorization

References

github.com/grokability/snipe-it/security/advisories/GHSA-xf36-wx48-5rqp (vendor-advisory)
www.vulncheck.com/advisories/snipe-it-before-8.6.3-authentication-bypass-via-go… (third-party-advisory)

Frequently asked questions

What is CVE-2026-116199?: CVE-2026-116199 is a high-severity vulnerability in Grokability Snipe-It, classified under Improper Authorization. CVSS score: 8.1/10. Published 2026-10-25.
How severe is CVE-2026-116199?: High severity. CVSS v3 base score is 8.1 out of 10.