CVE-2026-86772: Snipe-IT Stored XSS Vulnerability

CVE-2026-86772 Overview

CVE-2026-86772 is a stored cross-site scripting (XSS) vulnerability in Snipe-IT, an open-source IT asset management platform. The flaw affects Snipe-IT versions prior to 8.7.0 and resides in the DepartmentPresenter::formattedNameLink() method. Department names are rendered without HTML escaping in the fallback branch used for users who lack the departments.view permission. An authenticated user with departments.edit permission can inject malicious JavaScript into a department name. The payload executes in the browsers of all department members when they load their My Assets page [CWE-79].

Critical Impact
Any authenticated user with departments.edit permission can persistently inject JavaScript that runs in the browsers of assigned department members, enabling session theft, account takeover, or unauthorized actions within Snipe-IT.

Affected Products

Snipe-IT versions prior to 8.7.0
Snipe-IT 8.6.3 (confirmed in VulnCheck advisory)
Snipe-IT deployments where department-based user assignment is used

Discovery Timeline

2026-09-09 - CVE-2026-86772 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86772

Vulnerability Analysis

The vulnerability exists in Snipe-IT's presenter layer, which formats model attributes for display in the user interface. The DepartmentPresenter::formattedNameLink() method returns an HTML anchor when the current user holds departments.view permission. For users without that permission, the method falls back to returning the raw department name string, and this fallback branch omits HTML escaping.

Because department names are stored user-controlled data, any script content persists in the database and is served to every user assigned to that department. This turns a routine display path into a stored XSS sink that fires on the My Assets page.

Root Cause

The root cause is missing output encoding in a conditional rendering branch. Snipe-IT escapes department names correctly in the anchor path but treats the plaintext fallback as safe. Output encoding must be applied uniformly regardless of the presentation branch to prevent cross-site scripting.

Attack Vector

Exploitation requires an authenticated account with the departments.edit permission. The attacker edits or creates a department, embedding a JavaScript payload in the name field. Once saved, the payload is served to any department member who visits their My Assets view. User interaction is required in the form of the victim loading the page.

A successful attack executes JavaScript in the victim's authenticated session context. The attacker can read session tokens, issue API calls on behalf of the victim, exfiltrate asset data, or pivot to higher-privileged accounts if an administrator loads the affected view. Technical details are available in the GitHub Security Advisory GHSA-3j84-c68v-g76m and the VulnCheck Advisory for Snipe-IT XSS.

Detection Methods for CVE-2026-86772

Indicators of Compromise

Department name fields containing HTML tags, <script> blocks, on* event handlers, or javascript: URIs.
Audit log entries showing department name modifications from accounts with departments.edit permission.
Unexpected outbound HTTP requests from user browsers originating on the Snipe-IT My Assets page.
Session token or cookie values appearing in web server access logs as query parameters.

Detection Strategies

Query the Snipe-IT departments table for names containing angle brackets, quotes, or JavaScript keywords.
Review application audit logs for department create and update events performed by non-administrator accounts.
Enable and monitor Content Security Policy (CSP) violation reports for inline script execution on Snipe-IT pages.
Baseline normal department naming conventions and alert on entries that deviate significantly in length or character set.

Monitoring Recommendations

Track HTTP POST and PUT requests to /departments endpoints and inspect payloads for script content.
Monitor authenticated session activity for privilege escalation following a department name change.
Correlate anomalous browser telemetry, such as unexpected DOM modifications, with Snipe-IT session cookies.

How to Mitigate CVE-2026-86772

Immediate Actions Required

Upgrade Snipe-IT to version 8.7.0 or later, which contains the fix for CVE-2026-86772.
Audit all existing department names for embedded HTML or JavaScript and sanitize any suspicious entries.
Review which accounts hold the departments.edit permission and remove it from users who do not require it.
Force session invalidation for all users after remediation to revoke any tokens potentially captured during exploitation.

Patch Information

The maintainers fixed the vulnerability in Snipe-IT 8.7.0 by applying consistent HTML escaping in the DepartmentPresenter::formattedNameLink() fallback branch. Refer to the GitHub Security Advisory GHSA-3j84-c68v-g76m for patch commits and upgrade instructions.

Workarounds

Restrict the departments.edit permission to a minimal set of trusted administrators until patching is complete.
Deploy a strict Content Security Policy that disallows inline scripts and untrusted script sources on the Snipe-IT origin.
Place Snipe-IT behind a web application firewall (WAF) with rules that block script tags and event handlers in department name parameters.

bash

# Example CSP header to reduce stored XSS impact until patching
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'";