CVE-2022-1155: 
PHP vulnerability analysis and mitigation

A session management vulnerability was identified in Snipe-IT versions prior to 5.3.10, tracked as CVE-2022-1155. The vulnerability stems from a flaw where old sessions are not properly blocked by the login enable function, potentially allowing unauthorized access to the system (Debian Security).

The vulnerability exists in the session management functionality of Snipe-IT, specifically in how the system handles user activation states. When a user's activated status is switched to off, their existing sessions were not properly terminated, allowing continued access despite the deactivation (GitHub Commit).

The vulnerability could allow users whose accounts have been deactivated to maintain access to the system through existing sessions, potentially bypassing intended access restrictions and compromising system security (Debian Security).

The vulnerability could be exploited by maintaining an active session after account deactivation. This would allow continued system access even after administrative action to disable the account (GitHub Commit).

The vulnerability has been fixed in Snipe-IT version 5.3.10 and later. The fix includes implementation of proper session termination when a user's activated status is switched to off, ensuring that existing sessions are properly invalidated (GitHub Commit).