CVE-2026-55481
Snipe-IT: CSS Injection via `header_color` Setting
CVSS Score
0.0
EPSS Score
0.4%
EPSS Percentile
31th
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, default.blade.php renders header_color and related branding color settings inside a CSS style block with HTML escaping that is insufficient for the CSS context, allowing a superadmin to inject arbitrary CSS that affects authenticated users on subsequent page loads when Content Security Policy is disabled. This issue is fixed in version 8.6.2.
| CWE | CWE-79 |
| Vendor | grokability |
| Product | snipe-it |
| Published | Jul 10, 2026 |
| Last Updated | Jul 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for grokability snipe-it
Be the first to know when new unknown vulnerabilities affecting grokability snipe-it are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
grokability / snipe-it
< 8.6.2
References
github.com: https://github.com/grokability/snipe-it/security/advisories/GHSA-w7qw-5wfv-gwx9 github.com: https://github.com/grokability/snipe-it/pull/19097 github.com: https://github.com/grokability/snipe-it/commit/c31190a128ec96fb34000a2f27eae198b1a51d40 github.com: https://github.com/grokability/snipe-it/releases/tag/v8.6.2