CVE-2026-55481: Snipeitapp Snipe-it XSS Vulnerability

CVE-2026-55481 Overview

CVE-2026-55481 is a stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT, an open source IT asset and license management system. The flaw exists in default.blade.php, which renders header_color and related branding color settings inside a CSS <style> block. HTML escaping applied to these values is insufficient for the CSS context, permitting a superadmin to inject arbitrary CSS that executes against authenticated users on subsequent page loads. The issue is exploitable only when Content Security Policy (CSP) is disabled, which is the default configuration prior to version 8.6.2. The vulnerability is tracked under CWE-79 and is fixed in Snipe-IT 8.6.2.

Critical Impact
A superadmin can persistently inject CSS that alters the appearance and behavior of authenticated user sessions, enabling UI redressing, credential-harvesting overlays, and defacement across the tenant.

Affected Products

Snipe-IT versions prior to 8.6.2
Deployments where ENABLE_CSP is set to false (default before 8.6.2)
Self-hosted Snipe-IT instances managed by snipeitapp

Discovery Timeline

2026-07-10 - CVE-2026-55481 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-55481

Vulnerability Analysis

Snipe-IT allows superadmins to customize branding colors, including header_color, through the application settings. These values are stored in the database and later rendered directly into a CSS <style> block within the default.blade.php layout. The application applies HTML entity escaping to the values, but HTML escaping does not neutralize characters that are meaningful inside a CSS context, such as {, }, :, and ;. As a result, an attacker with superadmin privileges can supply values that break out of the intended CSS property and inject arbitrary CSS declarations.

On subsequent page loads, every authenticated user renders the attacker-controlled CSS. While CSS alone cannot execute JavaScript, it can be weaponized to hide legitimate UI elements, overlay fake login prompts, exfiltrate data via attribute selectors and background image requests, or facilitate clickjacking. When CSP is disabled, the injected content is applied without restriction against inline styles or external resource loads.

Root Cause

The root cause is context-inappropriate output encoding. Blade's default {{ }} escaping targets HTML contexts, not CSS. Rendering unvalidated user input into a <style> block without a CSS-specific validator or a strict allowlist for color values enables injection. The fix in pull request #19097 introduces a dedicated CssColor validation rule and flips the default ENABLE_CSP setting to true.

Attack Vector

Exploitation requires an authenticated superadmin account, so this is a privileged-user attack scenario rather than an unauthenticated compromise. A malicious or compromised superadmin submits crafted branding color values through the settings interface. Once stored, the payload is delivered to every user of the application on subsequent page renders.

php

// Patch excerpt: app/Http/Controllers/ProfileController.php
 use App\Models\Setting;
 use App\Models\User;
 use App\Notifications\CurrentInventory;
+use App\Rules\CssColor;
 use Illuminate\Contracts\View\View;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;

Source: grokability/snipe-it commit c31190a

Detection Methods for CVE-2026-55481

Indicators of Compromise

Unexpected CSS syntax such as }, {, url(, or @import in the header_color or related branding settings stored in the settings table.
Outbound HTTP requests from user browsers to unknown domains referenced by background-image: url(...) declarations originating from Snipe-IT pages.
Unauthorized changes to superadmin accounts or new superadmin creation events preceding branding modifications.

Detection Strategies

Query the Snipe-IT database for branding color values that do not conform to a strict color literal pattern such as ^#[0-9A-Fa-f]{3,8}$ or a named CSS color.
Review audit logs for Setting model updates targeting color fields, correlating actor, timestamp, and source IP.
Inspect rendered HTML from default.blade.php for CSS rules that extend beyond a single property declaration.

Monitoring Recommendations

Enable and monitor Snipe-IT application logs for changes to system settings, especially the appearance section.
Alert on any modification to the ENABLE_CSP environment variable or changes to CSP report endpoints.
Track browser-side CSP violation reports if CSP is enabled after upgrading, to surface residual injection attempts.

How to Mitigate CVE-2026-55481

Immediate Actions Required

Upgrade Snipe-IT to version 8.6.2 or later, which introduces the CssColor validation rule and enables CSP by default.
Set ENABLE_CSP=true in the Snipe-IT .env file for all deployments, including those pending upgrade.
Review the list of superadmin accounts, rotate credentials, and enforce multi-factor authentication for privileged users.
Inspect current branding color settings and reset any values that contain characters outside a valid color literal.

Patch Information

The fix is delivered in Snipe-IT release v8.6.2. The change is documented in pull request #19097 and commit c31190a. The advisory is published as GHSA-w7qw-5wfv-gwx9. The patch adds a server-side validator that rejects branding values not matching a valid CSS color and defaults Content Security Policy to enabled.

Workarounds

Set ENABLE_CSP=true in the environment configuration to block execution of injected CSS-driven external resource loads.
Restrict superadmin role assignment to a minimal number of trusted operators until the upgrade is complete.
Manually sanitize header_color and related branding fields in the database to enforce a strict hex color format.

bash

# Configuration example - enforce CSP in Snipe-IT .env
APP_TRUSTED_PROXIES=192.168.1.1,10.0.0.1
ALLOW_IFRAMING=false
REFERRER_POLICY=same-origin
ENABLE_CSP=true
ADDITIONAL_CSP_URLS=null
CORS_ALLOWED_ORIGINS=null
ENABLE_HSTS=true