CVE-2026-86745 grokability CVE debrief

Who should care

Defenders responsible for Snipe-IT deployments should assess exposure and apply the patch. This includes IT asset management teams and security personnel responsible for ensuring the integrity of Snipe-IT instances.

Why it matters

CVE-2026-86745 allows an authenticated user to inject spreadsheet formulas into the location-scoping report, enabling data exfiltration or command execution when opened by a superuser. Defenders should verify exposure, apply the patch, and monitor for suspicious activity.

• Potential data exfiltration through injected formulas.
• Possible command execution on Windows Excel through legacy DDE.
• Verification of exposure and patch application priority.
• Monitoring for suspicious activity related to the location-scoping report.

Technical summary

The SettingsController::downloadLocationScopingReport function in Snipe-IT streams a location-scoping mismatch report as a CSV file without applying proper formula escaping. An authenticated user with create/edit rights can inject spreadsheet formulas into free-text fields, enabling data exfiltration or command execution when a superuser downloads and opens the report in a spreadsheet application with formula evaluation enabled.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as the vulnerability allows for potential data exfiltration or command execution.

Recommended defensive actions

• Verify if the Snipe-IT instance is vulnerable by checking the version and applying the patch to version 8.7.0.
• Restrict access to the location-scoping report to prevent unauthorized users from injecting formulas.
• Monitor for suspicious activity related to the location-scoping report.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is confirmed in Snipe-IT master-branch builds after 8.6.3 and is fixed in version 8.7.0. The issue requires an authenticated user with ordinary create/edit rights to inject formulas.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.