---
id: CVE-2026-61807
title: Snipe-IT is an IT asset/license management system
summary: >-
  Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored
  manufacturer or supplier name passed as the table component $name becomes
  data-selected-count-id in resources/views/partials/bootstrap-table.blade.php.
  Client-si…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: snipeitapp
product: snipe-it
affected:
  - snipe-it < 8.6.2
patched:
  - snipe-it 8.6.2
published: '2026-08-19'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T12:49:27.233'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61807'
references:
  - url: >-
      https://github.com/grokability/snipe-it/commit/d12ad3d53869443b96b663ba3ce2673ef343da71
    label: security-advisories@github.com
  - url: 'https://github.com/grokability/snipe-it/releases/tag/v8.6.2'
    label: security-advisories@github.com
  - url: >-
      https://github.com/grokability/snipe-it/security/advisories/GHSA-c8qc-wf67-342w
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-c8qc-wf67-342w'
tags:
  - nvd
  - ghsa
  - composer
epss: 0.00212
epssPercentile: 0.11464
aliases:
  - GHSA-c8qc-wf67-342w
ecosystem: composer
ingestedAt: '2026-08-19T19:44:02.480Z'
---

## Overview

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a selector, concatenates countId.substring(1) into an HTML string, and passes the string to jQuery .after(). A crafted name can therefore execute JavaScript when an authenticated user views the manufacturer detail page or supplier detail page, potentially exposing data or actions available to that session. This issue is fixed in version 8.6.2.

## Affected

- `snipe-it < 8.6.2`

## Remediation

Upgrade past the affected range:

- `snipe-it 8.6.2`

## Package advisory (CVE-2026-61807)

Affected packages:

- `snipe/snipe-it < 8.6.2`

Patched in:

- `snipe/snipe-it 8.6.2`

Source: https://github.com/advisories/GHSA-c8qc-wf67-342w