Privilege escalation via unescaped accessory checkout notes

Stored XSS in Snipe-IT before 8.3.4 allows remote authenticated users to execute JavaScript in an administrator's session. The Accessory Checkout Notes field stores attacker-supplied script content, and the administrator user page renders it without neutralizing active markup. Accessory-management permission and an administrator viewing the assigned user's page are required; execution in the privileged session enables account-level privilege escalation.