External risk intelligence

Snipe-IT Superuser CSS Injection Via Custom CSS Allows Account Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-86738

Snipe-IT is an IT asset management application commonly deployed as a web-based service. While the vulnerability requires superuser privileges and specifically targets the Custom CSS field, the application itself is a web interface typically accessible over the network and often hosted in internet-facing or wide-access internal environments.

Cross-site Scripting

Snipeitapp Snipe It

3.0.0 to before 8.7.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in Snipe-IT's custom CSS feature allows privileged users to inject malicious code that could lead to the theft of sensitive information and account takeover for other administrators. This issue arises from incomplete sanitization of user-provided CSS, enabling attackers to craft specific styles that exfiltrate security tokens.

Unsanitized custom CSS allows admin account takeover.
Critical for protecting privileged access and data.
Confirm relevance and assess exposure to protected data.

Attack Path

How an attacker could exploit the issue

An attacker with superuser privileges can inject malicious CSS code into the Custom CSS field. This code can be crafted to exfiltrate sensitive information, such as CSRF tokens, from other superusers when they interact with the application. The vulnerability arises from improper handling of HTML encoding in the Custom CSS input, allowing attackers to construct payloads that are executed in the context of other users.

Requires superuser access.
Injects malicious CSS via Custom CSS.
Enables account takeover via token exfiltration.

Live Threat

Current exploitation, exposure, and threat context

A CSS injection vulnerability could allow a malicious actor with superuser privileges to craft specific CSS payloads. When rendered by other superusers, these payloads could exfiltrate sensitive CSRF tokens, potentially enabling account takeover.

User session tokens at risk.
Malicious CSS via Custom CSS field.
Account takeover of other superusers.

Operational Fix

Recommended remediation, mitigation, and detection steps

The most practical first step is for teams managing the Snipe-IT application, likely IT or platform owners, to identify all instances of the software. This should be followed by an assessment of each instance's exposure and business criticality to prioritize remediation efforts, which may involve coordination with vendor management if applicable.

Identify affected Snipe-IT instances.
Verify superuser access and custom CSS usage.
Plan targeted remediation or access controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Snipe-IT and how is it used?

Snipe-IT is an open-source IT asset management application used by organizations to track hardware, software licenses, and accessories. It provides a web-based interface for IT teams to maintain inventory records and assign equipment to users.

What does CSS injection mean for CVE-2026-86738?

This vulnerability falls under the CWE-79 class, which involves Cross-Site Scripting. In this specific case, the software fails to properly sanitize the Custom CSS field. By reversing HTML encoding, it allows the injection of malicious style rules that can secretly extract security data when viewed by others.

How can an attacker trigger this vulnerability?

An attacker must already possess superuser-level access to the application to modify the Custom CSS field. Ordinary user accounts or external visitors without administrative privileges cannot trigger this bug, as it requires the ability to input and save styles that affect how other users see the application.

Is my Snipe-IT instance relevant to this threat?

According to Halo Surface Signal, Snipe-IT is typically deployed as a web-based service. Because it is often hosted in internet-facing or wide-access internal environments, any instance accessible over a network is relevant. You should prioritize assessment if your installation allows superuser access across shared environments.

How do I respond to this vulnerability?

First, identify all active Snipe-IT instances within your organization. Review your current superuser access logs to ensure only authorized personnel have administrative rights. Finally, update the software to version 8.7.0 or later to ensure the Custom CSS field is properly sanitized.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.