CVE-2026-116200

The software Snipe-IT versions before 8.6.3 is vulnerable to an LDAP StartTLS Downgrade via the Ldap::connectToLdap() function. The root cause is that the application ignores the return value of ldap_start_tls(), which allows an on-path attacker to intercept the connection and force a cleartext L...