Improper File Deletion in Snipe-IT Results in Data Exposure

CVE-2026-86740

What is CVE-2026-86740?

Snipe-IT versions prior to 8.7.0 contain a vulnerability where the application fails to properly validate the completion of file deletion processes via Storage::delete(). As a result, administrators may receive misleading success notifications after attempting to delete files. Although these files may no longer appear in the application's user interface, they remain on the server, accessible to individuals with the necessary filesystem or backup access. This flaw poses a significant risk of unintended data exposure, potentially allowing sensitive information to be retrieved even after perceived deletion.

References