CVE-2026-86740

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-86740
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86740.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-86740
Aliases
  • GHSA-4c4h-cpgf-h4qr
Published
2026-09-09T13:32:06Z
Modified
2026-09-11T03:48:43Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remains
Details

Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in UploadedFilesController::destroy() and Api\UploadedFilesController::destroy(), allowing deletion requests to report success while files remain on disk. Administrators performing attachment deletions receive success responses and see files hidden from listings, but the physical files persist on disk and remain accessible to anyone with filesystem or backup access.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-212"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86740.json"
}
References

Affected packages

Git / github.com/grokability/snipe-it

Affected ranges

Type
GIT
Repo
https://github.com/grokability/snipe-it
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1d05a7ce11e6bf9448c067ac3ffbe5e63882888e
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "8.7.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

3.*
3.2.0
5.*
5.1.7
v3.*
v3.0
v3.0-alpha
v3.0-alpha2
v3.0-beta.1
v3.0-beta.3
v3.0.0-beta
v3.1.0
v3.3.0-beta
v3.4.0-alpha
v3.4.0-beta
v3.5.0
v3.5.0-beta
v3.5.0-beta2
v3.5.1
v3.5.2
v3.6.0
v3.6.1
v3.6.2
v3.6.3
v3.6.4
v3.6.5
v3.6.6
v4.*
v4.0
v4.0-alpha-2
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.14
v4.0.15
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v4.1.0
v4.1.1
v4.1.10
v4.1.11
v4.1.12
v4.1.13
v4.1.14
v4.1.2
v4.1.3
v4.1.4
v4.1.5
v4.1.6
v4.1.7
v4.1.8
v4.1.9
v4.2.0
v4.3.0
v4.4.0
v4.4.1
v4.5.0
v4.6.0
v4.6.1
v4.6.10
v4.6.11
v4.6.12
v4.6.13
v4.6.14
v4.6.15
v4.6.16
v4.6.17
v4.6.18
v4.6.2
v4.6.3
v4.6.4
v4.6.5
v4.6.6
v4.6.7
v4.6.8
v4.6.9
v4.7.0
v4.7.2
v4.7.3
v4.7.4
v4.7.5
v4.7.7
v4.7.8
v4.8.0
v4.9.0
v4.9.1
v4.9.2
v4.9.3
v4.9.4
v5.*
v5.0.0-beta-3.0
v5.0.0-beta-4
v5.0.0-beta-5
v5.0.0-beta-6-GM
v5.0.0-beta-7-GM
v5.0.10
v5.0.11
v5.0.12
v5.0.5
v5.0.6
v5.0.7
v5.0.8
v5.0.9
v5.1.0
v5.1.1
v5.1.2
v5.1.3
v5.1.4
v5.1.6
v5.1.7
v5.1.8
v6.*
v6.0.0
v6.0.0-GM
v6.0.0-RC-1
v6.0.0-RC-2
v6.0.0-RC-3
v6.0.0-RC-4
v6.0.0-RC-5
v6.0.0-RC-6
v6.0.0-RC-7
v6.0.0-RC-8
v6.0.1
v6.0.10
v6.0.3
v6.0.4
v6.0.5
v6.0.6
v6.3.0
v6.3.1
v7.*
v7.0.0-pre
v7.0.10
v7.0.13
v7.0.5
v7.0.6
v7.0.7
v7.0.8
v7.0.9
v7.1.14
v7.1.15
v8.*
v8.0.1
v8.0.2
v8.0.3
v8.0.4
v8.1.0
v8.1.1
v8.1.15
v8.1.16
v8.1.17
v8.1.18
v8.1.2
v8.1.3
v8.1.4
v8.2.0
v8.2.1
v8.3.0
v8.3.1
v8.3.2
v8.3.3
v8.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86740.json"