Snipe-IT IT Asset Management Application Vulnerability Affecting Data Export
CVE-2026-86745

5.1MEDIUM

Key Information:

Vendor

Grokability

Status
Snipe-it
Vendor
CVE Published:
9 September 2026

What is CVE-2026-86745?

The Snipe-IT IT asset management application contains a vulnerability that allows authenticated users to exploit CSV exports by injecting formulas into free-text fields. This occurs when the application generates a location-scoping mismatch report without applying necessary protections against formula execution. Attackers can craft malicious entries that, when processed by applications like Excel, trigger unintended actions, ultimately leading to data leaks. The issue has been addressed in version 8.7.0, where the export mechanism has been secured by applying the required formula escaping functionality.

Affected Version(s)

snipe-it 0 < 8.7.0

snipe-it 8.7.0

References

https://github.com/grokability/snipe-it/security/advisori...
vendor-advisory
https://www.vulncheck.com/advisories/snipe-it-before-8.7....
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

arpitjain099
snipe
.