Executive brief
Snipe-IT is an open-source asset management platform used by organizations to track IT hardware and software inventory. A stored cross-site scripting vulnerability in the department display feature allows users with department editing permissions to inject malicious code into department names. When other department members view their asset dashboard, the injected code executes in their browser with full access to their authenticated session, enabling account takeover or privilege escalation.
Technical details
The vulnerability is a stored cross-site scripting (CWE-79) flaw in the DepartmentPresenter::formattedNameLink() method. The vulnerable code correctly HTML-escapes department names for authenticated users with the departments.view permission, but fails to escape them in the fallback branch used for users without that permission—which represents the majority of users. An attacker holding the departments.edit permission can rename a department to a JavaScript payload; the payload is stored in the database and executes unescaped when victims load their "My Assets" page (/account/view-assets). The attack requires low privileges (the granular departments.edit permission, commonly granted to department managers) and near-certain user interaction (victims routinely visit the asset dashboard). The fix was committed to the develop branch on 2026-07-13 and released in version 8.7.0.
Affected products
- Snipe-IT Snipe-IT before 8.7.0
Timeline
- 2026-09-09: disclosed
- 2026-07-13: patched: Fixed in commit 36d472489c on develop branch
- 2026-08-24: advisory: GHSA-3j84-c68v-g76m published