CVE Alert: CVE-2026-86738 – grokability – snipe

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url() references to exfiltrate CSRF tokens from other superusers via attribute-selector rules, enabling account takeover.

## AI Summary Analysis

**Risk verdict:** High-impact exposure requiring prompt remediation, but there is no supplied evidence of active exploitation, KEV listing, or automated attack activity.

**Why this matters:** A compromised privileged account could expose sensitive asset, user and administrative data, alter records, and compromise other privileged sessions. The changed scope means impact may extend beyond the initially affected application, although the requirement for elevated privileges limits the initial attacker pool.

**Most likely attack path:** An attacker first obtains or abuses a superuser account, then reaches the internet-facing administration function over the network and places crafted content in the customisation field. Low attack complexity, no additional conditions and no victim interaction make subsequent execution reliable; the high-privilege requirement is the principal barrier. Successful exploitation could capture session-related secrets from other administrators and enable lateral movement into application administration or connected systems.

**Who is most exposed:** Organisations exposing Snipe-IT to the internet, particularly those using shared superuser accounts, weak administrative access controls, or integrations containing sensitive inventory and identity data. Privileged helpdesk and IT asset-management teams warrant immediate review.

Audit custom CSS changes, authors, timestamps and unexpected external references.

proxy, DNS and browser telemetry for unusual outbound requests from administrator sessions.

Review privileged logins, session creation and account changes around suspicious edits.

Alert on access to administrative functions from new geographies, hosts or user agents.

Mitigation and prioritisation:

Upgrade to the vendor-fixed release promptly; treat remediation as high priority.

Restrict administrative access through VPN, SSO/MFA, IP allow-lists and least privilege.

Review and rotate affected administrator sessions and credentials after cleanup.

Remove untrusted customisations and assess whether sensitive data was accessed.

EPSS and PoC status are not provided; obtain them to refine exploitation likelihood.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.