CVE-2026-86772

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0

Description A stored cross-site scripting issue exists in the formattedNameLink() function within DepartmentPresenter. This occurs because department names are rendered without proper escaping in the fallback branch for users lacking the departments.view permission. An attacker with departments.edit permission can inject malicious scripts into department names, which then execute in the browsers of all department members when they access the My Assets page.

Recommendations Update to version 8.7.0 or later. As a temporary mitigation, restrict the departments.edit permission to trusted administrators only.