CVE-2026-86772

5.4 Moyenne

Publiée le 09/09/2026 à 16:17 · Modifiée le 16/09/2026 à 22:28 · Analysée par le NVD · Source : disclosure@vulncheck.com

Description

Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink() where department names are rendered unescaped in the fallback branch for users without departments.view permission. Users with departments.edit permission can inject malicious scripts into department names that execute in the browsers of all department members when they load their My Assets page.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
4.0	5.1 Moyenne	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	5.4 Moyenne	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-79

Références

https://github.com/grokability/snipe-it/security/advisories/GHSA-3j84-c68v-g76m ExploitVendor Advisory
https://www.vulncheck.com/advisories/snipe-it-8.6.3-stored-xss-via-department-names Third Party Advisory

CVE-2026-86772

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs