Is CVE-2026-86772 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86772 being exploited in the wild.

How severe is CVE-2026-86772?

Medium severity, with a CVSS score of 5.4, published 9 September 2026.

Which products and versions are affected?

Snipe-IT Snipe-IT before 8.7.0.

Is there a fix for CVE-2026-86772?

A patch was published on 2026-07-13: Fixed in commit 36d472489c on develop branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86772 attacked?

It is attacked over the network.

Am I affected by CVE-2026-86772?

Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86772: Snipe-IT stored cross-site scripting in department names

CVE-2026-86772 · Severity: medium · CVSS 5.4 · Published 2026-09-09

Snipe-IT is an open-source asset management platform used by organizations to track IT hardware and software inventory. A stored cross-site scripting vulnerability in the department display feature allows users with department editing permissions to inject malicious code into department names. When other department members view their asset dashboard, the injected code executes in their browser with full access to their authenticated session, enabling account takeover or privilege escalation.

Technologies: Snipeitapp Snipe-It. Vendors: Snipeitapp.

Quick answers

Is CVE-2026-86772 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86772 being exploited in the wild.
How severe is CVE-2026-86772?: Medium severity, with a CVSS score of 5.4, published 9 September 2026.
Which products and versions are affected?: Snipe-IT Snipe-IT before 8.7.0.
Is there a fix for CVE-2026-86772?: A patch was published on 2026-07-13: Fixed in commit 36d472489c on develop branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86772 attacked?: It is attacked over the network.
Am I affected by CVE-2026-86772?: Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored cross-site scripting (CWE-79) flaw in the DepartmentPresenter::formattedNameLink() method. The vulnerable code correctly HTML-escapes department names for authenticated users with the departments.view permission, but fails to escape them in the fallback branch used for users without that permission—which represents the majority of users. An attacker holding the departments.edit permission can rename a department to a JavaScript payload; the payload is stored in the database and executes unescaped when victims load their "My Assets" page (/account/view-assets). The attack requires low privileges (the granular departments.edit permission, commonly granted to department managers) and near-certain user interaction (victims routinely visit the asset dashboard). The fix was committed to the develop branch on 2026-07-13 and released in version 8.7.0.

Affected products

Snipe-IT Snipe-IT before 8.7.0

Timeline

2026-09-09: disclosed
2026-07-13: patched: Fixed in commit 36d472489c on develop branch
2026-08-24: advisory: GHSA-3j84-c68v-g76m published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.