CVE-2026-86738

Publié : 8 septembre 2026

Modifié : 8 septembre 2026

Score CVSS

8.7

HIGH

Description détaillée

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url() references to exfiltrate CSRF tokens from other superusers via attribute-selector rules, enabling account takeover.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Références et Patchs

https://github.com/grokability/snipe-it/commit/d26d71688359707f3b257fc04fe6c3e5a17405f9 https://github.com/grokability/snipe-it/security/advisories/GHSA-pvcw-mp8q-mj39 https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-css-injection-via-custom-css

Dernières Vulnérabilités

CVE-2026-86853

A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1.

VOIR DÉTAILS

CVE-2026-86840

The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered `channel_id` when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. This allows an attacker to inflate a channel's recorded mint volume and cause protocol commission payments to be disproportionately distributed to that channel during commission settlement.

VOIR DÉTAILS

CVE-2026-86737

snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets.

VOIR DÉTAILS