CVE-2026-62368 grokability CVE debrief

Who should care

Defenders responsible for Snipe-IT deployments, especially those with users having customfields.create permission, should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-62368 is a high-severity vulnerability in Snipe-IT that allows stored markup execution, potentially leading to data exposure and privilege escalation. Defenders should prioritize verifying exposure, especially in deployments with users having customfields.create permission, and ensure remediation by updating to version 8.7.0 or later.

• Potential same-origin data exposure.
• Authenticated actions with victim's privileges.
• Potential privilege escalation when a superuser views the affected list.
• Verification of Snipe-IT version and user permissions is required.

Technical summary

The vulnerability exists in Snipe-IT versions prior to 8.7.0. A user with customfields.create permission can store markup in CustomField.name, which is then unescaped and executed as a bootstrap-table header title when another user views an asset-list page associated with the fieldset. This can lead to same-origin data exposure and authenticated actions with the victim's privileges, including potential privilege escalation when a superuser views the affected list. The issue is fixed in version 8.7.0, and defenders should prioritize verifying exposure in Snipe-IT deployments, especially where users have customfields.create permission.

Defensive priority

Defenders should prioritize verifying exposure in Snipe-IT deployments, especially where users have customfields.create permission, and assess the impact of stored markup execution on page load.

Recommended defensive actions

• Verify Snipe-IT version and ensure it is updated to 8.7.0 or later.
• Restrict customfields.create permission to trusted users.
• Monitor for suspicious activity on asset-list pages.
• Implement additional security measures to prevent stored markup execution.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 8.1 and HIGH severity. The issue is fixed in Snipe-IT version 8.7.0. Defenders should verify Snipe-IT deployments, especially where users have customfields.create permission, and assess the impact of stored markup execution on page load. Evidence is limited to public CVE and NVD information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.