CVE-2026-49870: CWE-770: Allocation of Resources Without Limits or Throttling in grokability snipe-it

CVE-2026-49870 describes a resource allocation and authentication bypass vulnerability in Snipe-IT before version 8.6.1. The POST /two-factor endpoint does not enforce rate limiting or lockout mechanisms, enabling attackers with valid credentials to brute-force TOTP codes within the configured window. Successful guesses grant full authentication. Furthermore, when two_factor_enabled is set to 1, users can disable two-factor authentication without OTP verification by submitting POST /account/profile with two_factor_optin=0, unless required mode 2 is enabled. Administrators can also reset other users' two-factor secrets via POST /api/v1/users/two_factor_reset. These flaws collectively weaken two-factor authentication protections. The vendor fixed these issues in version 8.6.1.

An attacker with valid credentials can perform unlimited TOTP guesses due to lack of rate limiting, potentially gaining full authenticated sessions without proper two-factor verification. Users can disable two-factor authentication without OTP verification under certain settings, reducing account security. Administrators can reset two-factor secrets for other users, which could be abused if administrator accounts are compromised. The vulnerability impacts confidentiality and integrity of user accounts but does not affect availability.

Upgrade Snipe-IT to version 8.6.1 or later, where these vulnerabilities are fixed. The vendor advisory confirms the issue is resolved in 8.6.1. No additional mitigations are required once the update is applied.