{"id":"CVE-2026-62368","revision":"004031d1dfe24224bafd19b603aef7f7","records":[{"revision":"004031d1dfe24224bafd19b603aef7f7","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-62368","aliases":[],"title":"Snipe-IT: Stored XSS via Custom Field name in asset-list column headers","description":"Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page associated with the fieldset, the stored markup executes on page load in that user's Snipe-IT session. This can expose same-origin data and perform authenticated actions with the victim's privileges, including privilege escalation when a superuser views the affected list. This issue is fixed in version 8.7.0.","state":0,"publishedAt":"2026-09-24T16:40:34.11+00:00","modifiedAt":"2026-09-24T17:13:38.717+00:00","affected":[{"ecosystem":"Vendor product","name":"snipe-it","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"grokability\",\n                    \"product\": \"snipe-it\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 8.7.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","score":8.1,"severity":"HIGH"}],"references":["https://github.com/grokability/snipe-it/security/advisories/GHSA-p9h3-gvpq-5539","https://github.com/grokability/snipe-it/commit/58754e4e3b86b58a0c4523012ef04a2ae990d2c8","https://github.com/grokability/snipe-it/releases/tag/v8.7.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-62368","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-62368","identifiers":["CVE-2026-62368"]},"retained":false,"historicalAffected":[]}],"coverage":[]}