CVE-2026-86748

MEDIUM 6.1

Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism.

CWE	CWE-460
Vendor	grokability
Product	snipe-it
Published	Sep 9, 2026
Last Updated	Sep 9, 2026

Stay Ahead of the Next One

Get instant alerts for grokability snipe-it

Be the first to know when new medium vulnerabilities affecting grokability snipe-it are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Affected Versions

grokability / snipe-it

0 < 8.7.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/grokability/snipe-it/security/advisories/GHSA-4cr5-3hw8-8w5f vulncheck.com: https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-database-wipe-via-invalid-backup-archive

Credits

christopherfi-dev snipe