CVE-2026-86738

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0

Description Incomplete sanitization in the Custom CSS field allows for CSS injection because HTML encoding on greater-than and double-quote characters is reversed. Superusers can inject malicious CSS payloads using @import and url() references. This allows the exfiltration of CSRF (Cross-Site Request Forgery) tokens—unique tokens used to prevent unauthorized commands from being transmitted from a user the web application trusts—from other superusers via attribute-selector rules, which can lead to account takeover.

Recommendations Update to version 8.7.0 or later.