PatchSiren cyber security CVE debrief

CVE-2026-86748 grokability CVE debrief

CVE-2026-86748 is a medium-severity vulnerability in Snipe-IT versions before 8.7.0 that can lead to permanent data loss. The vulnerability exists in the restore endpoint, which wipes the database before validating the uploaded backup archive. Superusers uploading corrupted or invalid zip files can trigger this issue with no recovery path or rollback mechanism. Snipe-It administrators and security teams should assess exposure and prioritize remediation due to the potential for permanent data loss. The CVE record and NVD entry indicate that Snipe-IT versions before 8.7.0 are vulnerable to permanent data loss due to a flawed restore endpoint. The vulnerability has a CVSS score of 6.9

Vendor: grokability
Product: snipe-it
CVSS: MEDIUM 6.9
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-09-09
Original CVE updated: 2026-09-14
Advisory published: 2026-09-09
Advisory updated: 2026-09-14

Who should care

Snipe-It administrators and security teams should assess exposure and prioritize remediation due to the potential for permanent data loss. They should review and update Snipe-It to version 8.7.0 or later, restrict access to the restore endpoint for superusers, and implement additional validation for uploaded backup archives. Affected Snipe-It deployments in managed environments require immediate attention to prevent

Why it matters

CVE-2026-86748 is a medium-severity vulnerability in Snipe-IT versions before 8.7.0 that can lead to permanent data loss. Snipe-It administrators and security teams should assess exposure and prioritize remediation.

Potential for permanent data loss due to flawed restore endpoint
Lack of recovery path or rollback mechanism for corrupted or invalid backups
Need for additional validation and access controls for the restore endpoint

Technical summary

Snipe-IT versions before 8.7.0 contain a flawed restore endpoint that wipes the database before validating the uploaded backup archive. Superusers uploading corrupted or invalid zip files can trigger permanent data loss with no recovery path or rollback mechanism.

Defensive priority

Medium priority for Snipe-It administrators and security teams

Recommended defensive actions

Review and update Snipe-It to version 8.7.0 or later
Restrict access to the restore endpoint for superusers
Implement additional validation for uploaded backup archives
Monitor for suspicious activity related to the restore endpoint

Evidence notes

The CVE record and NVD entry indicate that Snipe-IT versions before 8.7.0 are vulnerable to permanent data loss due to a flawed restore endpoint. Superusers uploading corrupted or invalid zip files can trigger this issue with no recovery path or rollback mechanism.

Sources and references

Verified primary and authoritative sources

CVE-2026-86748 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-86748

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-86748 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-86748

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://github.com/grokability/snipe-it/security/advisories/GHSA-4cr5-3hw8-8w5f

[email protected] - Exploit, Vendor Advisory, Mitigation, Patch
Source reference
Unverified legacy reference

URL: https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-database-wipe-via-invalid-backup-archive

[email protected] - Third Party Advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.