{"id":"CVE-2026-62368","title":"Snipe-IT is an IT asset/license management system","summary":"Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-ta…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","cwe":["CWE-79"],"vendor":"snipe","product":"snipe/snipe-it","affected":["snipe/snipe-it < 8.7.0"],"patched":["snipe/snipe-it 8.7.0"],"published":"2026-09-24","updated":"2026-09-25","sourceUpdated":"2026-09-25T13:36:08.630","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-62368","references":[{"url":"https://github.com/grokability/snipe-it/commit/58754e4e3b86b58a0c4523012ef04a2ae990d2c8","label":"security-advisories@github.com"},{"url":"https://github.com/grokability/snipe-it/releases/tag/v8.7.0","label":"security-advisories@github.com"},{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-p9h3-gvpq-5539","label":"security-advisories@github.com"},{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-p9h3-gvpq-5539","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-p9h3-gvpq-5539"}],"tags":["nvd","ghsa","composer","cve.org","exploit-available"],"aliases":["GHSA-p9h3-gvpq-5539"],"ecosystem":"composer","exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-09-24T17:13:19.981641Z"},"ingestedAt":"2026-09-24T16:47:15.847Z","slug":"CVE-2026-62368","body":"## Overview\n\nSnipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page associated with the fieldset, the stored markup executes on page load in that user's Snipe-IT session. This can expose same-origin data and perform authenticated actions with the victim's privileges, including privilege escalation when a superuser views the affected list. This issue is fixed in version 8.7.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-62368)\n\nAffected packages:\n\n- `snipe/snipe-it < 8.7.0`\n\nPatched in:\n\n- `snipe/snipe-it 8.7.0`\n\nSource: https://github.com/advisories/GHSA-p9h3-gvpq-5539","depth":"midnight","depthScore":57,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":210298,"id":"CVE-2026-62368","ts":1790272145806,"field":"exploit_available","old":"false","new":"true"}]}