CVE-2026-86740: Improper Removal of Sensitive Information Before Storage or Transfer in grokability snipe-it
Snipe-IT versions prior to 8.7.0 have a vulnerability where deletion requests for uploaded files report success even though the files remain on disk. This occurs because the application does not check the return value of the Storage::delete() function in certain controller methods. As a result, administrators see files removed from listings but the physical files persist and remain accessible to anyone with filesystem or backup access.
AI Analysis
Technical Summary
CVE-2026-86740 affects Snipe-IT before version 8.7.0. The vulnerability arises from the failure to verify the success of the Storage::delete() operation in UploadedFilesController::destroy() and Api\UploadedFilesController::destroy(). This allows deletion requests to falsely report success while the actual files are not deleted from disk. Consequently, files that administrators believe are deleted remain physically present and accessible on the filesystem or backups.
Potential Impact
The vulnerability leads to improper removal of sensitive information before storage or transfer. Files intended to be deleted remain accessible on disk, potentially exposing sensitive data to unauthorized users with filesystem or backup access. This undermines data confidentiality and could lead to data leakage.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should verify file deletions at the filesystem level and consider additional manual cleanup procedures to ensure sensitive files are fully removed.
CVE-2026-86740: Improper Removal of Sensitive Information Before Storage or Transfer in grokability snipe-it
Description
Snipe-IT versions prior to 8.7.0 have a vulnerability where deletion requests for uploaded files report success even though the files remain on disk. This occurs because the application does not check the return value of the Storage::delete() function in certain controller methods. As a result, administrators see files removed from listings but the physical files persist and remain accessible to anyone with filesystem or backup access.
CVSS v4.0
Score 5.1medium
Affected software
pkg:github/grokability/snipe-itRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-86740 affects Snipe-IT before version 8.7.0. The vulnerability arises from the failure to verify the success of the Storage::delete() operation in UploadedFilesController::destroy() and Api\UploadedFilesController::destroy(). This allows deletion requests to falsely report success while the actual files are not deleted from disk. Consequently, files that administrators believe are deleted remain physically present and accessible on the filesystem or backups.
Potential Impact
The vulnerability leads to improper removal of sensitive information before storage or transfer. Files intended to be deleted remain accessible on disk, potentially exposing sensitive data to unauthorized users with filesystem or backup access. This undermines data confidentiality and could lead to data leakage.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should verify file deletions at the filesystem level and consider additional manual cleanup procedures to ensure sensitive files are fully removed.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-08T11:31:38.679Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6aa164b5acd9273b49685933
Added to database: 09/09/2026, 13:52:53 UTC
Last enriched: 09/09/2026, 14:23:43 UTC
Last updated: 09/09/2026, 18:33:48 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.