PT-2026-57290 · Grokability · Snipe-It

Publicado 2026-07-10 · Atualizado 2026-07-10 · CVE-2026-55481

NVD

CVSS v4.0

6.2

Média

Vetor base

AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, default.blade.php renders header color and related branding color settings inside a CSS style block with HTML escaping that is insufficient for the CSS context, allowing a superadmin to inject arbitrary CSS that affects authenticated users on subsequent page loads when Content Security Policy is disabled. This issue is fixed in version 8.6.2.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-55481

Produtos afetados

Snipe-It

Referências · 5

• https://github.com/grokability/snipe-it/commit/c31190a128ec96fb34000a2f27eae198b1a51d40 · Nota
• https://github.com/grokability/snipe-it/pull/19097 · Nota
• https://github.com/grokability/snipe-it/security/advisories/GHSA-w7qw-5wfv-gwx9 · Nota
• https://github.com/grokability/snipe-it/releases/tag/v8.6.2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-55481 · Nota de Segurança