CVE-2026-86740
Last modified
CVE-2026-86740 is a low-severity vulnerability rated 3.8/10 on the CVSS scale. Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in UploadedFilesController::destroy() and Api\\UploadedFilesController::destroy(), allowing deletion requests to report success while files remain on disk. Administrators performing attachment deletions receive success responses and see files hidden from listings, but the physical files persist on disk and remain accessible to anyone with filesystem or backup access..
Description
Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in UploadedFilesController::destroy() and Api\\UploadedFilesController::destroy(), allowing deletion requests to report success while files remain on disk. Administrators performing attachment deletions receive success responses and see files hidden from listings, but the physical files persist on disk and remain accessible to anyone with filesystem or backup access.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| grokability | snipe-it | < 8.7.0 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-86740?
How severe is CVE-2026-86740?
How do I fix CVE-2026-86740?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-86734Snipe-IT before 8.7.1 fails to validate the length of the no…6.5
- CVE-2026-86735snipe-it versions before 8.7.0 contain a server-side request…5
- CVE-2026-86736snipe-it before 8.7.0 contains an incorrect calculation vuln…4.3
- CVE-2026-86737snipe-it versions before 8.7.0 fail to enforce asset view au…4.3
- CVE-2026-86738Snipe-IT versions before 8.7.0 contain a CSS injection vulne…8.7
- CVE-2026-86739Snipe-IT 8.6.3 and earlier do not check the return value of …3.1
- CVE-2026-86741Snipe-IT versions before 8.7.0 fail to sanitize the category…8.5
- CVE-2026-86742Snipe-IT through 8.6.3 does not neutralize formula elements …6.5
- CVE-2026-86743Snipe-IT versions before 8.7.0 fail to properly scope asset …5
- CVE-2026-86744Snipe-IT 8.6.3 and earlier (and develop pre-release commits …2.2
- CVE-2026-86745Snipe-IT is an IT asset management application. In Snipe-IT …6.5
- CVE-2026-86746Snipe-IT before 8.7.0 contains an authorization bypass vulne…6.4
Are you affected by CVE-2026-86740?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST