{"metadata": {"vulnerability": "CVE-2026-116199", "count": 21, "kinds": {"milestone": 4, "sighting": 8, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-10-08T00:00:00Z", "date_only": false, "value": "2026-10-08T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-116199", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-25T12:27:58.643Z", "date_only": false, "value": "2026-10-25T12:27:58.643Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-116199", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-25T13:20:31.815Z", "date_only": false, "value": "2026-10-25T13:20:31.815Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-116199", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-25T13:20:31.815Z", "date_only": false, "value": "2026-10-25T13:20:31.815Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-116199", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-25T13:30:24.770Z", "date_only": false, "value": "2026-10-25T13:30:24.770788Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117501789735000991", "record": "cve-2026-116199", "field": "creation_timestamp", "uuid": "7ee46c06-5627-444f-8451-b66297162151", "content": "CRITICAL: grokability Snipe-IT (<8.6.3) suffers improper auth in GoogleAuthController (CVE-2026-116199). Deactivated users can regain admin via Google SSO. Patch to 8.6.3+ now. https://radar.offseq.com/threat/cve-2026-116199-improper-authorization-in-grokability-snipe-it-c10467b7c5886087 #OffSeq #CVE2026116199 #SnipeIT #Vuln", "url": "https://infosec.exchange/users/offseq/statuses/117501789735000991"}, {"timestamp": "2026-10-25T13:30:26.622Z", "date_only": false, "value": "2026-10-25T13:30:26.622725Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mypcvopobn2x", "record": "cve-2026-116199", "field": "creation_timestamp", "uuid": "9b90df96-7957-4cf6-8569-7c408cb31bae", "content": "CVE-2026-116199: CRITICAL auth bypass in grokability Snipe-IT (<8.6.3). Deactivated users with Google SSO can regain admin. Upgrade ASAP. https://radar.offseq.com/threat/cve-2026-116199-improper-authorization-in-grokability-snipe-it-c10467b7c5886087 #OffSeq #CVE2026116199 #SnipeIT", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mypcvopobn2x"}, {"timestamp": "2026-10-25T14:08:26.003Z", "date_only": false, "value": "2026-10-25T14:08:26.003635Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117501939253101858", "record": "CVE-2026-116199", "field": "creation_timestamp", "uuid": "5a151f86-a495-426b-bd01-48b561613a4a", "content": "CVE-2026-116199 Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can sign in via Google SSO and regain sessions at their original permission level, including admin.\nhttps://www.cve.org/CVERecord?id=CVE-2026-116199https://github.com/grokability/snipe-it/security/advisories/GHSA-xf36-wx48-5rqphttps://www.vulncheck.com/advisories/snipe-it-before-8.6.3-authentication-bypass-via-google-sso-callback#grokability #snipe-it#CVE_2026_116199#bot", "url": "https://infosec.exchange/users/cve/statuses/117501939253101858"}, {"timestamp": "2026-10-25T14:17:00Z", "date_only": false, "value": "2026-10-25T14:17:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-9CJX-RMHJ-QC37", "record": "GHSA-9CJX-RMHJ-QC37", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-25T14:17:00.593Z", "date_only": false, "value": "2026-10-25T14:17:00.593", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-116199", "record": "FKIE_CVE-2026-116199", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-25T14:40:05.319Z", "date_only": false, "value": "2026-10-25T14:40:05.319599Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mypgsa5aly2p", "record": "CVE-2026-116199", "field": "creation_timestamp", "uuid": "001d1215-d617-4532-a6f7-5a7c377d66e0", "content": "CVE-2026-116199 - snipe-it\nVersions of Snipe\u2011IT earlier than 8.6.3 let a user whose account has been disabled sign in using Google single sign\u2011on. The system does not check whether the account is still\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#snipeit #grokability #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mypgsa5aly2p"}, {"timestamp": "2026-10-25T15:02:43.065Z", "date_only": false, "value": "2026-10-25T15:02:43.065620Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mypi2ol3in23", "record": "CVE-2026-116199", "field": "creation_timestamp", "uuid": "8ed33bc0-b867-4887-930f-0b765b76e0fb", "content": "\ud83d\udfe0 CVE-2026-116199 - High (8.1)\n\nSnipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCall...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-116199/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mypi2ol3in23"}, {"timestamp": "2026-10-25T15:32:22Z", "date_only": false, "value": "2026-10-25T15:32:22Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-9CJX-RMHJ-QC37", "record": "GHSA-9CJX-RMHJ-QC37", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-25T15:32:22Z", "date_only": false, "value": "2026-10-25T15:32:22Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-9CJX-RMHJ-QC37", "record": "GHSA-9CJX-RMHJ-QC37", "field": "modified"}, {"timestamp": "2026-10-25T15:36:36.237Z", "date_only": false, "value": "2026-10-25T15:36:36.237756Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threatroundup.bsky.social/post/3mypjxc2vtc2z", "record": "CVE-2026-116199", "field": "creation_timestamp", "uuid": "87c3e6b1-e8f6-4ff5-924c-6ff7e9400c82", "content": "Patch watch: CVE-2026-116199 (grokability snipe-it, CVSS 9.2). Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in\u2026 No public exploit reported yet. #CVE #infosec\n\nthreatroundup.com/cve/cve-2026...", "url": "https://bsky.app/profile/threatroundup.bsky.social/post/3mypjxc2vtc2z"}, {"timestamp": "2026-10-25T16:07:15.257Z", "date_only": false, "value": "2026-10-25T16:07:15.257861Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3myplo3xbi22b", "record": "CVE-2026-116199", "field": "creation_timestamp", "uuid": "06e71351-2a12-4278-8c23-7203eabb9966", "content": "\ud83d\udea8 CVE-2026-116199 \u2014 CVSS 9.2 CRITICAL\n\nSnipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, whic...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-116199\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3myplo3xbi22b"}, {"timestamp": "2026-10-26T15:39:52.964Z", "date_only": false, "value": "2026-10-26T15:39:52.964297Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-116199", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-26T15:39:52.964Z", "date_only": false, "value": "2026-10-26T15:39:52.964297Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-116199", "record": "FKIE_CVE-2026-116199", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-26T16:41:49.682Z", "date_only": false, "value": "2026-10-26T16:41:49.682Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-116199", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-26T16:41:49.682Z", "date_only": false, "value": "2026-10-26T16:41:49.682Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-116199", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-26T19:01:58.533Z", "date_only": false, "value": "2026-10-26T19:01:58.533", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-116199", "record": "FKIE_CVE-2026-116199", "field": "lastModified"}, {"timestamp": "2026-10-27T02:07:07.702Z", "date_only": false, "value": "2026-10-27T02:07:07.702758Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3myt5nobyv22g", "record": "CVE-2026-116199", "field": "creation_timestamp", "uuid": "749bcfb8-2555-4ffe-a06b-ac5f0df68bae", "content": "\ud83d\udccc CVE-2026-116199 - Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches t... https://www.cyberhub.blog/cves/CVE-2026-116199", "url": "https://bsky.app/profile/cyberhub.blog/post/3myt5nobyv22g"}], "metrics": {"as_of": "2026-11-01T04:56:35.885Z", "anchors": {"origin": {"timestamp": "2026-10-08T00:00:00Z", "date_only": false, "value": "2026-10-08T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-116199", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-08T00:00:00Z", "date_only": false, "value": "2026-10-08T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-116199", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 2091395.88571, "hours": 580.9433015861111, "days": 24.205970899421295, "min_seconds": 2004995.88571, "max_seconds": 2091395.88571, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-08T00:00:00Z", "date_only": false, "value": "2026-10-08T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-116199", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-01T04:56:35.885Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}