Snipe-IT CVE-2026-86748

Exploitation requires an active Snipe-IT superuser account; standard user or administrator roles below superuser level cannot access the restore endpoint. The superuser must actively upload a file to the restore endpoint (UI:P in CVSS 4.0 terms, analogous to UI:R in 3.1). No special server-side configuration or non-default feature flag is required - the restore endpoint is part of the standard Snipe-IT installation. What limits exploitation is exclusively the superuser privilege requirement: attackers must first compromise a superuser account or act as a malicious insider. The vulnerability is not exploitable by unauthenticated users or standard authenticated users. Network-level access to the Snipe-IT web interface is also required (AV:N).

The CVSS 4.0 base score of 6.9 accurately reflects the constrained attack surface: PR:H (superuser account required) and UI:P (the privileged user must actively initiate the upload) significantly limit opportunistic exploitation. No public exploit code has been identified and the vulnerability does not appear in CISA KEV, consistent with its high privilege barrier. Real-world risk is therefore bounded by the superuser population - even a mid-sized municipal IT team in kielce managing Snipe-IT deployments faces meaningful exposure only if a superuser account is compromised or a malicious insider is present. That said, the consequence when triggered is catastrophic: VI:H/VA:H with no recovery path means a single malicious or accidental upload to an unpatched instance can permanently destroy the asset inventory. Organizations without database backups external to Snipe-IT's built-in restore feature face complete data loss with no remediation path post-exploitation. The absence of POC code and the PR:H requirement make this a medium operational priority rather than an emergency, but the irreversibility of the impact justifies prompt patching.

An attacker who has obtained superuser credentials to a Snipe-IT instance - through phishing, credential stuffing, or insider access - navigates to the backup restore page and uploads a deliberately crafted or randomly corrupted ZIP file. The application immediately wipes the database in preparation for the restore, then fails to parse the invalid archive, leaving the database empty with no recovery path. The entire asset inventory is permanently destroyed in a single authenticated HTTP request.