CVE-2026-86738 in Snipe-IT
Summary
by MITRE • 09/08/2026
Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url() references to exfiltrate CSRF tokens from other superusers via attribute-selector rules, enabling account takeover.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in Snipe-IT versions prior to 8.7.0 represents a critical security flaw rooted in improper input validation within the Custom CSS configuration field. This issue is classified under CWE-79, which covers Cross-Site Scripting (XSS), specifically manifesting as a DOM-based or stored XSS variant depending on how the payload persists and executes. The core technical failure lies in the application's handling of HTML entities during the sanitization process. While the system attempts to neutralize malicious content by encoding special characters such as greater-than signs and double quotes, it performs this operation incorrectly. Specifically, the sanitization logic reverses or fails to properly maintain the encoded state for these specific characters when rendering CSS stylesheets. This incomplete sanitization allows an attacker with superuser privileges to inject raw HTML entities that are subsequently decoded by the browser during style application, effectively bypassing standard XSS filters designed to prevent script execution and data exfiltration through malicious markup injection.
From a technical perspective, this vulnerability enables sophisticated attack vectors leveraging CSS capabilities rather than traditional JavaScript-based attacks. By utilizing @import rules or url() references within the injected Custom CSS payload, an attacker can force the victim's browser to make external HTTP requests. These requests are not merely passive observations but can be crafted using attribute selectors and pseudo-elements to read specific DOM attributes from other superuser sessions. The most critical aspect of this exploit is its ability to exfiltrate Cross-Site Request Forgery (CSRF) tokens. Since Snipe-IT relies on CSRF protection for state-changing operations, stealing these tokens allows the attacker to bypass authentication mechanisms designed to prevent unauthorized actions. This transforms a visual styling issue into a severe account takeover vector, as the stolen token can be used in forged requests that appear legitimate to the server, granting the attacker full administrative control over the compromised superuser accounts without needing their passwords or multi-factor authentication codes.
The operational impact of this vulnerability is profound due to its high privilege requirement and precise execution conditions. Only users with superuser access can exploit this flaw because they are the only ones granted permission to modify global Custom CSS settings. However, once a single superuser account is compromised through social engineering or other means, an attacker can leverage their elevated privileges to inject the malicious stylesheet into all subsequent sessions viewed by other administrators. This creates a chain reaction where one breach leads to widespread administrative compromise across the organization's IT asset management infrastructure. The ability to exfiltrate CSRF tokens undermines the integrity of session management and request validation processes, potentially leading to unauthorized configuration changes, data manipulation, or complete system takeover. Given that Snipe-IT is often used as a central repository for organizational assets, compromising superuser accounts can expose sensitive inventory data, license information, and user credentials stored within the platform.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary defense is to upgrade immediately to version 8.7.0 or later, where this specific sanitization flaw has been corrected by properly maintaining HTML entity encoding for all special characters during CSS rendering. For environments unable to patch instantly, administrators should restrict access to the Custom CSS field through strict role-based access control policies, ensuring that only a minimal number of highly trusted individuals have permission to modify global stylesheets. Additionally, implementing Content Security Policy (CSP) headers can help mitigate the impact by restricting where resources like scripts and stylesheets can be loaded from, thereby blocking many @import and url() based exfiltration attempts. From an industry standard perspective, this vulnerability aligns with MITRE ATT&CK technique T1059.007 for JavaScript-based execution if script injection were possible, but more accurately reflects data exfiltration techniques such as Exfiltration Over Alternative Protocol (T1048) via CSS-driven network requests. Regular security audits focusing on input validation and output encoding consistency are essential to prevent similar flaws in future development cycles, ensuring that sanitization logic does not inadvertently reverse protective measures for specific character sets.