CVE-2026-86738EPSS p39.8%

CVE-2026-86738CVE-2026-86738

snipeitapp / snipe-it

Description

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url() references to exfiltrate CSRF tokens from other superusers via attribute-selector rules, enabling account takeover.

Scoring

CVSS 8.7 ()
VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
EPSS0.49% probability of exploitation · percentile 39.8% · 2026-10-05T12:00:23Z
Last modified2026-09-09
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.