CVE-2026-62368
Received Received - Intake

Stored XSS in Snipe-IT Asset Management System

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page associated with the fieldset, the stored markup executes on page load in that user's Snipe-IT session. This can expose same-origin data and perform authenticated actions with the victim's privileges, including privilege escalation when a superuser views the affected list. This issue is fixed in version 8.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-62368
EUVD
EUVD-2026-86292

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
snipe-it snipe-it 8.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Snipe-IT allows a user with customfields.create permission to inject malicious markup into a CustomField.name. When another user views an asset-list page linked to this field, the stored markup executes in their session, potentially exposing data or performing actions with their privileges.

Detection Guidance

Check Snipe-IT version for any instances below 8.7.0. Review CustomField.name values for stored markup in the database. Inspect asset-list pages for unexpected script execution or header titles.

Impact Analysis

An attacker could steal sensitive data like session tokens or perform actions on your behalf, including privilege escalation if a superuser views the affected list. This could lead to unauthorized access or data breaches within your Snipe-IT instance.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or modification, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Upgrade Snipe-IT to version 8.7.0 or later immediately. Remove or sanitize any malicious markup in CustomField.name values. Restrict customfields.create permission to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62368. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart