CVE-2022-1155: 
PHP vulnerability analysis and mitigation

A session management vulnerability was identified in Snipe-IT versions prior to 5.3.10, tracked as CVE-2022-1155. The vulnerability stems from a flaw where old sessions are not properly blocked by the login enable function, potentially allowing unauthorized access to the system (Debian Security).

The vulnerability exists in the session management functionality of Snipe-IT, specifically in how the system handles user activation states. When a user's activated status is switched to off, their existing sessions were not properly terminated, allowing continued access despite the deactivation (GitHub Commit).

The vulnerability could allow users whose accounts have been deactivated to maintain access to the system through existing sessions, potentially bypassing intended access restrictions and compromising system security (Debian Security).

The vulnerability has been fixed in Snipe-IT version 5.3.10 and later. The fix includes implementation of proper session termination when a user's activated status is switched to off, ensuring that existing sessions are properly invalidated (GitHub Commit).