CVE-2026-86772 is a stored cross-site scripting vulnerability in grokability's Snipe-IT product, affecting version 8.6.3. The vulnerability arises because department names are rendered unescaped in the fallback branch of the DepartmentPresenter::formattedNameLink() method for users lacking departments.view permission. Users with departments.edit permission can exploit this by injecting malicious scripts into department names, which then execute in the browsers of all department members when they access their My Assets page. This can lead to script execution attacks within the affected user context.

The vulnerability allows users with departments.edit permission to inject malicious scripts that execute in the browsers of department members when they load their My Assets page. This could lead to unauthorized actions or data exposure within the context of the affected application. The impact is limited by the requirement of departments.edit permission for exploitation and the vulnerability's medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict departments.edit permissions to trusted users only to reduce the risk of exploitation.