---
id: CVE-2026-86772
title: >-
  Snipe-IT versions before 8.7.0 contain a stored cross-site scripting
  vulnerability in DepartmentPresenter::formattedNameLink() where department
  names are rendered unescaped in the fallback branch for users without
  departments.view permis…
summary: >-
  Snipe-IT versions before 8.7.0 contain a stored cross-site scripting
  vulnerability in DepartmentPresenter::formattedNameLink() where department
  names are rendered unescaped in the fallback branch for users without
  departments.view permis…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: snipeitapp
product: snipe-it
affected:
  - snipe-it < 8.7.0
patched:
  - snipe-it 8.7.0
published: '2026-09-09'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T20:28:56.910'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86772'
references:
  - url: >-
      https://github.com/grokability/snipe-it/security/advisories/GHSA-3j84-c68v-g76m
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/snipe-it-8.6.3-stored-xss-via-department-names
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00251
epssPercentile: 0.14581
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-10T14:18:31.930235Z'
ingestedAt: '2026-09-12T05:46:42.735Z'
---

## Overview

Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink() where department names are rendered unescaped in the fallback branch for users without departments.view permission. Users with departments.edit permission can inject malicious scripts into department names that execute in the browsers of all department members when they load their My Assets page.

## Affected

- `snipe-it < 8.7.0`

## Remediation

Upgrade past the affected range:

- `snipe-it 8.7.0`