{"schema":"threatline.record/2","record":{"id":"CVE-2026-62368","aliases":["GHSA-p9h3-gvpq-5539"],"summary":"Snipe-IT: Stored XSS via Custom Field name in asset-list column headers","details":"### Impact\nA user with the \"customfields.create\" permission can store HTML/JS in a Custom Field name, which is later rendered as an asset-list column title WITHOUT escaping at app/Presenters/AssetPresenter.php line 364 ('title' => $field->name) and injected into the table header by the bundled bootstrap-table plugin. It executes for anyone who opens an asset list (e.g. /hardware), including superusers, on page load with no interaction. Since \"customfields.create\" can be granted to non-superusers, a lower-privileged user gets script execution in a superuser's session -> privilege escalation.\n\nSTEPS TO REPRODUCE\n1. As a user with \"customfields.create\", create a Custom Field named: `<img src=x onerror=alert(1)>`\n2. Add the field to a fieldset that is associated with an asset model.\n3. Open `/hardware` -> the payload executes on load.\n\nDEMONSTRATED IMPACT\nAn account holding ONLY \"customfields.create\" (HTTP 403 on /users) planted a payload that, when a superuser opened /hardware, issued an authenticated request in that session and granted the attacker's own account the \"superuser\" permission (afterwards: GET /users = 200, isSuperUser() = true).\n\nROOT CAUSE\n- Blade {{ }} encodes the data-columns attribute, but the browser decodes it back before bootstrap-table reads the title; bootstrap-table then renders the header title unescaped because its table-level \"escape\" option defaults to false and is never enabled. (The per-column 'escape' => true covers cell values, not the header title.)\n### Patches\nPatched in https://github.com/grokability/snipe-it/commit/58754e4e3b86b58a0c4523012ef04a2ae990d2c8","categories":["Libraries & packages"],"product":"snipe/snipe-it","vendor":"grokability","ecosystem":"composer","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-p9h3-gvpq-5539","source_modified_at":"2026-09-24T18:19:31Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"snipe/snipe-it"},"range":"< 8.7.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-62368","source_modified_at":"2026-09-24T17:13:38.717Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"snipe-it","vendor":"grokability","versions":[{"status":"affected","version":"< 8.7.0"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-p9h3-gvpq-5539","source_modified_at":"2026-09-24T18:28:27.139734651Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"snipe/snipe-it","ecosystem":"Packagist","purl":"pkg:composer/snipe/snipe-it"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.0"}]}],"versions":["3.2.0","v0.1.0","v0.1.1","v0.1.2","v0.2.0","v0.3.0-alpha","v0.3.10-alpha","v0.3.11-alpha","v0.3.7-alpha","v0.3.8-alpha","v0.3.9-alpha","v1.0","v1.1","v1.2.0","v1.2.1","v1.2.10","v1.2.11","v1.2.2","v1.2.3","v1.2.3-beta","v1.2.4","v1.2.4-beta","v1.2.5","v1.2.6","v1.2.6-beta","v1.2.6.1","v1.2.7","v1.2.7-beta","v1.2.8","v1.2.9","v2.0","v2.0-RC-1","v2.0-beta","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.0.5","v2.0.6","v2.1.0","v2.1.1","v2.1.2","v3.0","v3.0-alpha","v3.0-alpha2","v3.0-beta.1","v3.0-beta.2","v3.0-beta.3","v3.0.0-beta","v3.1.0"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-p9h3-gvpq-5539","source_modified_at":"2026-09-24T18:19:31Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"snipe/snipe-it"},"version":"8.7.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-p9h3-gvpq-5539","source_modified_at":"2026-09-24T18:28:27.139734651Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"snipe/snipe-it","ecosystem":"Packagist","purl":"pkg:composer/snipe/snipe-it"},"version":"8.7.0"}],"cvss":8.1,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00351,"percentile":0.2753,"score_date":"2026-10-23"},"published_at":"2026-09-24T16:40:34.110Z","modified_at":"2026-09-24T18:28:27.139734651Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-p9h3-gvpq-5539","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-24T18:19:31Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-62368","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-24T17:13:38.717Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-p9h3-gvpq-5539","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-09-24T18:28:27.139734651Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-62368","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-p9h3-gvpq-5539","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/grokability/snipe-it/commit/58754e4e3b86b58a0c4523012ef04a2ae990d2c8","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/grokability/snipe-it/releases/tag/v8.7.0","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-p9h3-gvpq-5539","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"total","assessed_at":"2026-09-24T17:13:19.981641Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-24T18:28:27.139734651Z","content_hash":"5a86ed6d58dcdfad0dac6f6aeb30116c7fc2009b5205907d628dcb98d123d52c"}}