PT-2026-57290 · Grokability · Snipe-It

Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-55481

NVD

CVSS v4.0

6.2

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, default.blade.php renders header color and related branding color settings inside a CSS style block with HTML escaping that is insufficient for the CSS context, allowing a superadmin to inject arbitrary CSS that affects authenticated users on subsequent page loads when Content Security Policy is disabled. This issue is fixed in version 8.6.2.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-55481

Affected Products

Snipe-It

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-55481 · Security Note
• https://github.com/grokability/snipe-it/commit/c31190a128ec96fb34000a2f27eae198b1a51d40 · Note
• https://github.com/grokability/snipe-it/pull/19097 · Note
• https://github.com/grokability/snipe-it/security/advisories/GHSA-w7qw-5wfv-gwx9 · Note
• https://github.com/grokability/snipe-it/releases/tag/v8.6.2 · Note