CVE-2026-86738 is a high severity CSS injection in Snipe-IT before 8.7.0. Sanitisation of the Custom CSS setting reverses encoding of greater-than and double-quote characters, so a superuser can plant CSS that sends other superusers' CSRF tokens to an external host. The fix is Snipe-IT 8.7.0.
What's affected
Affected: Snipe-IT before 8.7.0. Patched version: 8.7.0. The GitHub advisory GHSA-pvcw-mp8q-mj39 lists the affected version as v3.0, meaning the behaviour is old, and the patched version as 8.7.0.
The severity numbers differ a lot by source. The record gives CVSS 3.1 at 8.7 (High). The GitHub advisory rates it High. VulnCheck lists it as critical at 9.3 on CVSS 4.0. Because the attacker must already be a superuser, and a victim superuser must load a page, the practical risk sits nearer the lower figure for many deployments, but the account takeover impact is real. Nothing I read reports exploitation, and it is not in CISA KEV.
How to check if you're exposed
Check your Snipe-IT version. The web interface shows it in the footer and on the admin settings pages. For Docker, read the image tag, and for a Git install, run the command below in the application directory. Anything before 8.7.0 is affected.
git describe --tags
Then review who holds the highest privilege. The attack described needs a superadministrator or superuser account, so list those accounts, remove ones you do not need, and make sure each uses a unique password and multi factor authentication where available.
Also open the Custom CSS field under the application settings and read what is there. Look for @import rules and url() references that point to hosts you do not recognize. Any external reference in that field deserves an explanation.
What to do now
- Upgrade Snipe-IT to 8.7.0 or later.
- Inspect the Custom CSS setting for external @import and url() references, and remove any you cannot account for.
- Limit the number of superuser accounts and review who can edit settings.
- If you find an unexpected external reference, treat superuser sessions and CSRF tokens as exposed, sign everyone out, and review recent administrative changes.
- Use a Content Security Policy that restricts style sources and image loads to your own host, as an extra layer.
Why it matters
The record lists cross-site scripting (CWE-79) as the class, though the abuse here is CSS, not script. The application first encodes the stored CSS, then decodes the greater-than and double-quote characters again. CSS features that only need those characters, such as @import and external url() references, pass through.
The sanitised CSS is placed in a style block on every page for every signed in user. So CSS planted by one superuser runs in every other superuser's browser. CSS can select on attribute values, and the advisory describes using that to leak a token one character at a time to an external server. With a valid CSRF token, the attacker can forge state changing requests as the victim.
That makes it an insider or compromised-superuser attack, aimed at moving sideways to other superusers. A strict Content Security Policy is a good general defence against this whole style of attack.
Quick check
Does the attacker need to be a superuser?
Yes. The record says a superuser plants the CSS, and the victims are other superusers.
Why do the scores differ so much?
The record uses CVSS 3.1 (8.7) and VulnCheck uses CVSS 4.0 (9.3, critical). Scoring models weigh the account takeover impact differently.
Sources
- Snipe-IT GitHub advisory GHSA-pvcw-mp8q-mj39
- Snipe-IT fix commit d26d716
- VulnCheck advisory
- Safeguard Gold entry for CVE-2026-86738
Last reviewed: 18 October 2026.
