CVE-2026-86772

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-86772

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86772.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-86772

Aliases

GHSA-3j84-c68v-g76m

Published

2026-09-09T13:32:28Z

Modified

2026-09-10T03:48:29Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Snipe-IT 8.6.3 Stored XSS via Department Names

Details

Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink() where department names are rendered unescaped in the fallback branch for users without departments.view permission. Users with departments.edit permission can inject malicious scripts into department names that execute in the browsers of all department members when they load their My Assets page.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86772.json"
}

References

Affected packages

Git / github.com/grokability/snipe-it

Affected ranges

Type

GIT

Repo

https://github.com/grokability/snipe-it

Events

Introduced

cfd1ff8413e478a8daab700c15e96c96f93220e2

Fixed

1d05a7ce11e6bf9448c067ac3ffbe5e63882888e

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "8.6.3"
        },
        {
            "fixed": "8.7.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86772.json"