CVE-2026-86748

Publié : 9 septembre 2026

Modifié : 9 septembre 2026

Score CVSS

6.1

MEDIUM

Description détaillée

Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H

Références et Patchs

https://github.com/grokability/snipe-it/security/advisories/GHSA-4cr5-3hw8-8w5f https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-database-wipe-via-invalid-backup-archive https://github.com/grokability/snipe-it/security/advisories/GHSA-4cr5-3hw8-8w5f

Dernières Vulnérabilités

CVE-2026-82563

An attacker could impersonate the camera and place themselves in a man-in-the-middle or device-emulation position. This permits manipulation of device status responses, observation of application requests, and potential triggering of firmware-update behavior.

VOIR DÉTAILS

CVE-2026-81640

An attacker could derive the camera's Wi-Fi password and connect to its wireless network. This weakens or eliminates the security value of the access-point password and may expose the live video stream, device services, status interfaces, and firmware-update functionality.

VOIR DÉTAILS

CVE-2026-81330

The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP streams. The application manifest permits cleartext traffic, and captured network traffic contains reconstructable JPEG or WEBP video frames transmitted over UDP. An attacker within local wireless range may capture and reconstruct the live video stream without transport encryption.

VOIR DÉTAILS