Description

Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink() where department names are rendered unescaped in the fallback branch for users without departments.view permission. Users with departments.edit permission can inject malicious scripts into department names that execute in the browsers of all department members when they load their My Assets page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-09T14:17:27.890Z",
  "pubdate": "2026-09-09T14:17:27.890Z",
  "executiveSummary": "Snipe-IT versions prior to 8.7.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability located within the DepartmentPresenter::formattedNameLink() function.\nThe vulnerability allows an authenticated attacker possessing 'departments.edit' permissions to inject malicious JavaScript payloads into department names.\nThese payloads are rendered without proper sanitization or escaping when the application processes the department name in the fallback branch of the presenter, specifically affecting users lacking 'departments.view' permissions.\nWhen a targeted user, such as a department member, views their 'My Assets' page, the stored malicious script executes within the context of their active session.\nSuccessful exploitation permits unauthorized script execution in the victim's browser, potentially leading to session hijacking, sensitive data exfiltration, or unauthorized actions performed on behalf of the authenticated user.\nThe primary risk stems from the lack of output encoding, allowing for persistent cross-site scripting across the application environment.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the DepartmentPresenter::formattedNameLink() function to apply appropriate output encoding or sanitization before rendering department names in the HTML template.\nSpecifically, the vulnerability exists within the application's fallback branch, which is triggered when a user attempts to access department data without having the requisite 'departments.view' permission.\nAn attacker with 'departments.edit' privileges can manipulate the department name attribute to include arbitrary JavaScript payloads—for instance, by injecting tags like <script>alert(document.cookie)</script> or leveraging event handlers such as <img src=x onerror=alert(1)>.\nBecause the application stores this unsanitized input in the database, the payload persists and remains dormant until triggered by a specific request.\nThe attack flow proceeds as follows: First, the attacker updates a department name with a malicious script via the administrative interface. Second, a victim who is a member of that department navigates to their 'My Assets' page. Third, the application's presenter logic invokes DepartmentPresenter::formattedNameLink() to display the user's department. Fourth, because the victim lacks 'departments.view' permissions, the application enters the vulnerable fallback branch and outputs the malicious payload directly into the DOM without escaping characters that hold special meaning in HTML.\nUpon rendering, the victim's browser interprets the injected string as executable code rather than plain text. Since this occurs within the security context of the Snipe-IT application, the script gains access to the user's session tokens, local storage, and the ability to make asynchronous HTTP requests to the application's API using the victim's credentials.\nThis impact extends to all members of the affected department who load the vulnerable page, facilitating a broad attack surface for credential theft or malicious UI manipulation.\nThe vulnerability affects all Snipe-IT versions prior to 8.7.0 and requires valid authentication as a user with administrative-level department modification rights."
}