CVE-2026-86772: Snipe-IT 8.6.3 Stored XSS via Department Names
Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink() where department names are rendered unescaped in the fallback branch for users without departments.view permission. Users with departments.edit permission can inject malicious scripts into department names that execute in the browsers of all department members when they load their My Assets page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
snipe-itto a version that resolves this vulnerability.Fixed in 8.7.0 - Compensating control
Restrict the departments.edit permission so that only trusted users can create or edit department names (to prevent script injection into DepartmentPresenter::formattedNameLink() for users who lack departments.view permission).
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the injected script?
A user with departments.edit permission can create or modify a department name containing malicious script. The script executes for department members who do not have departments.view permission when they load the My Assets page.
Is user interaction required for exploitation?
Yes. A targeted department member must load their My Assets page for the stored script in the department name to execute in their browser.
Which versions should be remediated?
Snipe-IT versions before 8.7.0 are affected. Upgrade to 8.7.0 or later.