CVE-2026-62368: Snipe-IT Stored XSS via Custom Field Name in Asset-List Column Headers
Summary
CVE-2026-62368: Snipe-IT: Stored XSS via Custom Field name in asset-list column headers. Affects snipe/snipe-it versions < 8.7.0. Fixed in 8.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Snipe-IT is an open-source asset management system that allows organizations to manage their hardware and software assets efficiently. It provides features such as asset tracking, user management, and custom fields for asset details. However, a vulnerability exists that allows users with specific permissions to inject malicious scripts into the application, potentially compromising user sessions.
Vulnerability Detail
The vulnerability arises from improper handling of custom field names in Snipe-IT, specifically in the asset-list column headers. A user with the 'customfields.create' permission can store HTML/JavaScript in a custom field name. This data is rendered unescaped in the asset-list view, allowing for stored cross-site scripting (XSS) attacks. When a superuser accesses the asset list, the injected script executes automatically, leading to privilege escalation as the attacker can perform actions in the superuser's session.
How To Fix
Minimum fixed version
8.7.0
This is the first release that contains the fix.
composer require snipe/snipe-it:8.7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict the 'customfields.create' permission to trusted users only, minimizing the risk of XSS attacks until the package is updated.
Conclusion
The CVE-2026-62368 vulnerability in Snipe-IT allows for stored XSS attacks through custom field names, posing a significant risk to user sessions. It is crucial to update to version 8.7.0 or later to mitigate this risk and ensure the security of your asset management system.
See every vulnerability recorded for snipe/snipe-it →
FAQ
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
Any user with the 'customfields.create' permission in Snipe-IT is potentially affected, especially if they create malicious custom field names.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to privilege escalation, allowing attackers to execute scripts in the context of a superuser's session, potentially compromising sensitive data.
Yes, you can limit the 'customfields.create' permission to trusted users only as a temporary measure until the patch is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for snipe/snipe-it.
