Stored Cross-Site Scripting in Snipe-IT by Grokability

CVE-2026-86772

What is CVE-2026-86772?

Snipe-IT versions prior to 8.7.0 are susceptible to a stored cross-site scripting vulnerability. This issue arises in the DepartmentPresenter::formattedNameLink() function, where department names are not properly escaped for users lacking 'departments.view' permission. As a result, users with 'departments.edit' permission can insert malicious scripts into department names. When any department member accesses their 'My Assets' page, these scripts can execute in their browsers, potentially leading to unauthorized actions or data exposure.

References