CVE-2026-86748

MediumCVSS 6.1/10Last modified Sep 14, 2026

Description

Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-460

Affected software

No affected versions have been published.

Timeline

Published: Sep 9, 2026
Last modified: Sep 14, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-867496.3Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of storage write operations in ImageUploadRequest::handleImages().CVE-2026-867507.7Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate company assignment authorization before persisting user records via the REST API CVE-2026-867519.6Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server CVE-2026-867525.4snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on query-layer filtering i CVE-2026-867534.3snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/asset_model/{modelId} end CVE-2026-867547.3Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register CVE-2026-867555.4Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes (GET, POST, DELETE /oauth/perso CVE-2026-867566.1Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint (SamlController::acs, POST /sam CVE-2026-867576.5Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form templates for listbox, textarea, markdown CVE-2026-867586.5Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticate CVE-2026-867597.1Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary CVE-2026-86768.8An attacker is able to downgrade the security of a Bluetooth LE connection by deleting an existing bond, spoofing the bonded device and crea