---
id: CVE-2026-86740
title: >-
  Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in
  UploadedFilesController::destroy() and
  Api\\UploadedFilesController::destroy(), allowing deletion requests to report
  success while files remain on disk
summary: >-
  Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in
  UploadedFilesController::destroy() and
  Api\\UploadedFilesController::destroy(), allowing deletion requests to report
  success while files remain on disk. Admini…
severity: low
cvss: 3.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-212
vendor: snipeitapp
product: snipe-it
affected:
  - snipe-it < 8.7.0
patched:
  - snipe-it 8.7.0
published: '2026-09-09'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T20:49:15.543'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86740'
references:
  - url: >-
      https://github.com/grokability/snipe-it/security/advisories/GHSA-4c4h-cpgf-h4qr
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-attachment-deletion-reports-success-while-file-remains
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00292
epssPercentile: 0.19324
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-14T13:19:54.284290Z'
ingestedAt: '2026-09-14T15:23:07.419Z'
---

## Overview

Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in UploadedFilesController::destroy() and Api\\UploadedFilesController::destroy(), allowing deletion requests to report success while files remain on disk. Administrators performing attachment deletions receive success responses and see files hidden from listings, but the physical files persist on disk and remain accessible to anyone with filesystem or backup access.

## Affected

- `snipe-it < 8.7.0`

## Remediation

Upgrade past the affected range:

- `snipe-it 8.7.0`