Is CVE-2026-116199 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-116199?

CVE-2026-116199 has a CVSS v3 severity of HIGH (8.1).

Back

CVE-2026-116199

Description

Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can sign in via Google SSO and regain sessions at their original permission level, including admin.