CVE-2026-86738 is a critical CSS injection vulnerability in grokability's Snipe-IT product affecting versions before 8.7.0. The vulnerability stems from improper neutralization of input in the Custom CSS field, where HTML encoding on greater-than and double-quote characters is reversed, enabling superusers to plant malicious CSS. This malicious CSS can leverage @import and url() functions to exfiltrate CSRF tokens from other superusers through attribute-selector rules, facilitating account takeover. The CVSS 4.0 score is 9.3, indicating a critical severity with network attack vector, low attack complexity, and no user interaction required, but requiring high privileges (superuser).

An attacker with superuser privileges can exploit this vulnerability to inject malicious CSS that exfiltrates CSRF tokens from other superusers. This can lead to account takeover of those superusers, compromising administrative control of the Snipe-IT instance. The vulnerability affects confidentiality and integrity of the system and can result in significant security breaches.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict superuser access to trusted personnel only and monitor for suspicious activity related to CSS injection attempts in the Custom CSS field.