Executive brief
Snipe-IT is an open-source asset management system used by organizations to track IT inventory. A flaw in how the application sanitizes user-provided CSS allows a superuser to plant malicious CSS payloads that steal CSRF tokens from other superusers, leading to account takeover of any peer administrator account.
Technical details
The vulnerability is a CSS injection flaw in the custom CSS field (POST /admin/branding) caused by incomplete sanitization in Setting::show_custom_css(). The sanitization logic applies HTML encoding then selectively reverses it for greater-than and double-quote characters, leaving CSS syntax fully intact. An attacker can inject @import directives or url() references to attacker-controlled external stylesheets. Because the sanitized CSS is emitted in a global <style> block on every authenticated page load, a superuser can execute CSS-based data exfiltration via attribute-selector rules (e.g., input[name="_token"][value^="a"]) to steal CSRF tokens character by character from other superusers. Successful token exfiltration enables account takeover via forged state-changing requests. The vulnerability affects all versions through 8.6.3 and is fixed in 8.7.0.
Affected products
- Snipe-IT Snipe-IT 3.0 through 8.6.3
Timeline
- 2026-09-08: disclosed: CVE-2026-86738 published
- 2026-08-03: patched: Fix committed to repository (v8.7.0)
- 2026-08-24: other: GHSA-pvcw-mp8q-mj39 advisory published