CVE-2026-55481: Snipe-IT: CSS Injection via `header_color` Setting
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, default.blade.php renders headercolor and related branding color settings inside a CSS style block with HTML escaping that is insufficient for the CSS context, allowing a superadmin to inject arbitrary CSS that affects authenticated users on subsequent page loads when Content Security Policy is disabled. This issue is fixed in version 8.6.2.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55481?
CVE-2026-55481 has a medium severity rating of 6.2 according to the CVSS score.
How do I fix CVE-2026-55481?
To fix CVE-2026-55481, upgrade to Snipe-IT version 8.6.2 or later.
What exploitation can occur due to CVE-2026-55481?
CVE-2026-55481 allows an authenticated superadmin to inject arbitrary CSS that may affect other users.
Which software is affected by CVE-2026-55481?
CVE-2026-55481 affects versions of the Snipe-IT IT asset/license management system prior to 8.6.2.
Is CVE-2026-55481 related to XSS vulnerabilities?
Yes, CVE-2026-55481 is related to XSS as it involves CSS injection that can compromise the integrity of styles.