A stored cross-site scripting issue exists in the `formattedNameLink()` function within `DepartmentPresenter`. This occurs because department names are rendered without proper escaping in the fallback branch for users lacking the `departments.view` permission. An attacker with `departments.edit` permission can inject malicious scripts into department names, which then execute in the browsers of all department members when they access the My Assets page.