CVE-2026-86771: Server-Side Request Forgery (SSRF) in grokability snipe-it
Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML() function. Attackers can craft a malicious employee_num value containing an img tag with an arbitrary HTTP(S) URL to trigger server-side requests to internal services, cloud metadata endpoints, or external targets when a victim signs an asset acceptance.
AI Analysis
Technical Summary
Snipe-IT versions prior to 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator. This allows attackers with users.edit permission to inject img tags into TCPDF's writeHTML() function. By crafting a malicious employee_num containing an img tag with an arbitrary HTTP(S) URL, attackers can cause the server to make requests to internal services, cloud metadata endpoints, or external systems during asset acceptance signing. This constitutes a Server-Side Request Forgery (SSRF) vulnerability.
Potential Impact
An attacker with users.edit permission can exploit this vulnerability to make the server perform HTTP(S) requests to arbitrary internal or external endpoints. This can lead to unauthorized access to internal services or cloud metadata endpoints, potentially exposing sensitive information or enabling further attacks. The vulnerability has a high severity score of 8.3 (CVSS 4.0).
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict users.edit permissions to trusted users only to reduce the risk of exploitation.
CVE-2026-86771: Server-Side Request Forgery (SSRF) in grokability snipe-it
Description
Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML() function. Attackers can craft a malicious employee_num value containing an img tag with an arbitrary HTTP(S) URL to trigger server-side requests to internal services, cloud metadata endpoints, or external targets when a victim signs an asset acceptance.
CVSS v4.0
Score 8.3high
Affected software
pkg:github/grokability/snipe-itRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Snipe-IT versions prior to 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator. This allows attackers with users.edit permission to inject img tags into TCPDF's writeHTML() function. By crafting a malicious employee_num containing an img tag with an arbitrary HTTP(S) URL, attackers can cause the server to make requests to internal services, cloud metadata endpoints, or external systems during asset acceptance signing. This constitutes a Server-Side Request Forgery (SSRF) vulnerability.
Potential Impact
An attacker with users.edit permission can exploit this vulnerability to make the server perform HTTP(S) requests to arbitrary internal or external endpoints. This can lead to unauthorized access to internal services or cloud metadata endpoints, potentially exposing sensitive information or enabling further attacks. The vulnerability has a high severity score of 8.3 (CVSS 4.0).
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict users.edit permissions to trusted users only to reduce the risk of exploitation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-08T11:35:02.617Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6aa164baacd9273b49685b89
Added to database: 09/09/2026, 13:52:58 UTC
Last enriched: 09/09/2026, 14:07:11 UTC
Last updated: 09/09/2026, 21:33:23 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.