The vulnerability is a stored cross‑site scripting flaw within Snipe‑IT, an IT asset and license management system. A user with the customfields.create permission can store arbitrary markup in the name of a custom field. When the fieldset is used on an asset‑list page, the application inserts this name unescaped into the table header, causing the browser to execute the payload in the context of the logged‑in user. Because the execution occurs inside an authenticated session, it can read same‑origin data and perform privileged actions, even allowing a superuser to privilege‑escalate when they view the affected list.

The flaw affects the Snipe‑IT software provided by grokability. Any installation running a version older than 8.7.0 is vulnerable; the issue is fixed in v8.7.0 and later. No specific sub‑versions were identified in the advisory.

The CVSS score for this vulnerability is 8.1, indicating a high severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the web application interface because an authenticated user who has permission to create custom fields can inject the payload and a second user who is not a superuser but shares the same session will see it executed when they visit the asset‑list page.