CVE-2026-55481 is a CWE-79 cross-site scripting vulnerability in the Snipe-IT IT asset/license management system by grokability. The vulnerability arises because the default.blade.php template renders header_color and related branding color settings inside a CSS style block using HTML escaping that is insufficient for the CSS context. This allows a superadmin to inject arbitrary CSS code that affects authenticated users on subsequent page loads when Content Security Policy is disabled. The vulnerability is resolved in Snipe-IT version 8.6.2.

An authenticated superadmin can inject arbitrary CSS code that impacts other authenticated users when Content Security Policy is disabled. This can lead to UI manipulation or other CSS-based attacks affecting user experience or potentially leaking information via CSS side channels. The vulnerability requires high privileges (superadmin) and user interaction (authenticated users loading the page).

Upgrade Snipe-IT to version 8.6.2 or later, where this vulnerability is fixed. Since the vendor advisory does not specify an official remediation level or temporary fix, applying the official update is the recommended mitigation. Additionally, enabling a strict Content Security Policy can help mitigate the impact by preventing injected CSS from executing.