# CVE-2026-86772: Snipe-IT stored cross-site scripting in department names

Source: https://junglewise.ai/threats/cve-2026-86772-snipe-it-stored-cross-site-scripting-in-department-names  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86772 · Severity: medium · CVSS 5.4 · Published 2026-09-09

Snipe-IT is an open-source asset management platform used by organizations to track IT hardware and software inventory. A stored cross-site scripting vulnerability in the department display feature allows users with department editing permissions to inject malicious code into department names. When other department members view their asset dashboard, the injected code executes in their browser with full access to their authenticated session, enabling account takeover or privilege escalation.

Technologies: [Snipeitapp Snipe-It](https://junglewise.ai/threats/technologies/snipe-it). Vendors: [Snipeitapp](https://junglewise.ai/threats/vendors/snipeitapp).

## Quick answers

**Is CVE-2026-86772 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86772 being exploited in the wild.

**How severe is CVE-2026-86772?** Medium severity, with a CVSS score of 5.4, published 9 September 2026.

**Which products and versions are affected?** Snipe-IT Snipe-IT before 8.7.0.

**Is there a fix for CVE-2026-86772?** A patch was published on 2026-07-13: Fixed in commit 36d472489c on develop branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86772 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-86772?** Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored cross-site scripting (CWE-79) flaw in the DepartmentPresenter::formattedNameLink() method. The vulnerable code correctly HTML-escapes department names for authenticated users with the departments.view permission, but fails to escape them in the fallback branch used for users without that permission—which represents the majority of users. An attacker holding the departments.edit permission can rename a department to a JavaScript payload; the payload is stored in the database and executes unescaped when victims load their "My Assets" page (/account/view-assets). The attack requires low privileges (the granular departments.edit permission, commonly granted to department managers) and near-certain user interaction (victims routinely visit the asset dashboard). The fix was committed to the develop branch on 2026-07-13 and released in version 8.7.0.

## Affected products

- Snipe-IT Snipe-IT before 8.7.0

## Timeline

- 2026-09-09: disclosed
- 2026-07-13: patched: Fixed in commit 36d472489c on develop branch
- 2026-08-24: advisory: GHSA-3j84-c68v-g76m published

## References

- [https://github.com/grokability/snipe-it/security/advisories/GHSA-3j84-c68v-g76m](https://github.com/grokability/snipe-it/security/advisories/GHSA-3j84-c68v-g76m)
- [https://www.vulncheck.com/advisories/snipe-it-8.6.3-stored-xss-via-department-names](https://www.vulncheck.com/advisories/snipe-it-8.6.3-stored-xss-via-department-names)

## Related threats

- [Snipe-IT broken access control in Asset Model file attachments](https://junglewise.ai/threats/cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments)
- [Snipe-IT broken access control in Predefined Kit endpoints](https://junglewise.ai/threats/cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints)
- [Snipe-IT acceptance PDF server-side request forgery via unescaped employee_num](https://junglewise.ai/threats/cve-2026-86771-snipe-it-acceptance-pdf-server-side-request-forgery-via-unescaped)
- [Snipe-IT authentication bypass in SAML username collation](https://junglewise.ai/threats/cve-2026-86770-snipe-it-authentication-bypass-in-saml-username-collation)
- [Snipe-IT improper ownership management in consumables checkout API](https://junglewise.ai/threats/cve-2026-86769-snipe-it-improper-ownership-management-in-consumables-checkout)