Technical impact
The vulnerability exists in Snipe‑IT prior to version 8.6.2 where the header_color and related branding settings are rendered inside a style block without proper CSS‑context escaping. Because the HTML escape is insufficient for CSS, a super‑administrator can inject arbitrary CSS that is then executed in the browsers of all authenticated users on subsequent page loads when a restrictive Content Security Policy is not enforced. This allows the attacker to alter or suppress UI elements, potentially masking critical information or creating phishing‑like interfaces. The flaw is a classic cross‑site scripting issue, classified as CWE‑79.
Affected Systems
All Snipe‑IT deployments running any version earlier than 8.6.2 are affected. The software is maintained by the vendor grokability, and the issue was fixed in the 8.6.2 release which is available on GitHub.
Risk and Exploitability
The CVSS score of 6.2 indicates moderate severity, while the EPSS score of less than 1 % shows a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that the attacker already possesses super‑administrator privileges within the application and that CSP does not block inline styles. Under those conditions the risk is limited to UI manipulation for authenticated users, but the potential for social engineering and UI confusion warrants prompt remediation.
Github GHSA