CVE-2026-86748: Snipe-IT DOS Vulnerability

CVE-2026-86748 Overview

Snipe-IT versions before 8.7.0 contain a business logic flaw in the restore endpoint that causes permanent data loss. The application wipes the existing database before validating the uploaded backup archive. When a superuser uploads a corrupted or invalid zip file, the restore process destroys all production data with no rollback mechanism or recovery path. The vulnerability is categorized under [CWE-460] (Improper Cleanup on Thrown Exception) and affects the asset management platform's disaster recovery workflow.

Critical Impact
A single restore attempt with a malformed backup archive by a superuser results in complete and unrecoverable loss of the Snipe-IT database.

Affected Products

Snipe-IT asset management platform
All versions prior to 8.7.0
Self-hosted and containerized Snipe-IT deployments

Discovery Timeline

2026-09-09 - CVE-2026-86748 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86748

Vulnerability Analysis

Snipe-IT is an open-source IT asset management platform that supports database backup and restore operations from the administrative interface. The restore endpoint accepts a zip archive containing a previously exported database dump and application state.

The flaw resides in the ordering of operations within the restore workflow. The application truncates or drops existing database tables before parsing and validating the uploaded archive. If the archive is corrupted, incomplete, or not a valid Snipe-IT backup, the restore fails after the database has already been wiped.

Because no transactional rollback or pre-flight validation protects the destructive operation, the failure leaves the instance with an empty database. Administrators lose all asset records, user accounts, license data, and audit history.

Root Cause

The root cause is improper cleanup and ordering of a destructive operation. The restore handler performs the irreversible database wipe outside of a transaction and prior to archive validation. [CWE-460] describes this class of flaw where an application fails to maintain a consistent state when an operation throws an exception mid-execution.

Attack Vector

Exploitation requires superuser credentials on the target Snipe-IT instance and user interaction to upload the malformed archive. An attacker with hijacked superuser sessions, or an administrator making an honest mistake, can trigger the data loss condition. Any zip file that fails post-wipe validation, including truncated downloads, wrong-format archives, or intentionally crafted invalid backups, produces the same destructive outcome.

See the GitHub Security Advisory and Vulncheck Security Advisory for vendor-published technical details.

Detection Methods for CVE-2026-86748

Indicators of Compromise

Sudden reduction in Snipe-IT database row counts across assets, users, and licenses tables.
Application logs showing restore endpoint invocations followed by validation errors or exceptions.
Empty or default-state Snipe-IT dashboard after a restore attempt by a superuser account.

Detection Strategies

Monitor HTTP POST requests to the restore endpoint (/settings/backups/restore or equivalent) in web server access logs.
Alert on Snipe-IT application errors emitted immediately after restore operations that reference zip parsing or archive validation failures.
Track superuser authentication events correlated with backup restore activity outside of planned maintenance windows.

Monitoring Recommendations

Enable database query logging to capture TRUNCATE or DROP statements originating from the Snipe-IT application user.
Forward Snipe-IT application logs and web server logs to a centralized SIEM for correlation with administrative actions.
Establish baseline database size metrics and alert on abrupt reductions that indicate data loss events.

How to Mitigate CVE-2026-86748

Immediate Actions Required

Upgrade Snipe-IT to version 8.7.0 or later, which reorders the restore workflow to validate archives before wiping data.
Restrict superuser role assignments to the minimum number of administrators required for operations.
Take a verified out-of-band database backup before performing any restore operation.

Patch Information

The maintainers resolved the vulnerability in Snipe-IT 8.7.0. The fix ensures that the uploaded backup archive is parsed and validated before any destructive database operations execute. Consult the GitHub Security Advisory GHSA-4cr5-3hw8-8w5f for release details and upgrade guidance.

Workarounds

Disable access to the restore endpoint at the reverse proxy or web application firewall layer until the upgrade is applied.
Perform restore operations only against a staging instance, then promote the validated database to production.
Require dual-approval change management for any restore workflow while running vulnerable versions.

bash

# Example nginx rule to block the restore endpoint pending patch deployment
location ~ ^/settings/backups/restore {
    deny all;
    return 403;
}