CVE-2025-47226

Grokability Snipe-IT has incorrect authorization for accessing asset information

5.0 MediumPublic exploitFix available

Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

1.33%Up 1.3 points since May 3, 2025

What each source reports

CVE List Score used 5.0

Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.

Record: CVE-2025-47226
CVSS 3.1: 5.0 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Weakness: CWE-425
Updated: 2026-11-02

EUVDEUVD-2025-13304 5.0

Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.

Record: EUVD-2025-13304
CVSS 3.1: 5.0 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-h3vp-qwmx-5j25 5.0

Grokability Snipe-IT has incorrect authorization for accessing asset information

Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.

Record: GHSA-h3vp-qwmx-5j25
CVSS 3.1: 5.0 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Weakness: CWE-425, CWE-639
Updated: 2026-11-02

NVD 5.0

Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.

Record: CVE-2025-47226
CVSS 3.1: 5.0 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS 3.1: 3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-425, CWE-639
Updated: 2026-11-02

OSV 5.0

Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.

Record: CVE-2025-47226
CVSS 3.1: 5.0 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Weakness: CWE-425
Updated: 2026-11-02

OSVGHSA-h3vp-qwmx-5j25 5.0

Grokability Snipe-IT has incorrect authorization for accessing asset information

Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.

Record: GHSA-h3vp-qwmx-5j25
CVSS 3.1: 5.0 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Weakness: CWE-425, CWE-639
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`snipe/snipe-it` Packagist	before 8.1.0	8.1.0
`snipe/snipe-it` Packagist	before 8.1.0, plus listed versions 3.2.0v0.1.0v0.1.1v0.1.2v0.2.0 Show 45 moreShow less v0.3.0-alphav0.3.10-alphav0.3.11-alphav0.3.7-alphav0.3.8-alphav0.3.9-alphav1.0v1.1v1.2.0v1.2.1v1.2.10v1.2.11v1.2.2v1.2.3v1.2.3-betav1.2.4v1.2.4-betav1.2.5v1.2.6v1.2.6-betav1.2.6.1v1.2.7v1.2.7-betav1.2.8v1.2.9v2.0v2.0-RC-1v2.0-betav2.0.1v2.0.2v2.0.3v2.0.4v2.0.5v2.0.6v2.1.0v2.1.1v2.1.2v3.0v3.0-alphav3.0-alpha2v3.0-beta.1v3.0-beta.2v3.0-beta.3v3.0.0-betav3.1.0	8.1.0

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Grokability Snipe-IT 8.0.4 - Insecure Direct Object Reference (IDOR)	2025-05-06
PoC in GitHub	koyomihack00/CVE-2025-47226	2025-05-03

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-47226 is a medium vulnerability (CVSS 5.0) in Grokability, Inc. Snipe-it, published May 2, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.33%, the 71st percentile. Fixed in snipe/snipe-it 8.1.0.

References

This page doesn't list everything

Left out here: 204 versions. The JSON record has them.