CVE-2026-49870 describes a resource allocation and authentication flaw in grokability's Snipe-IT asset management system before version 8.6.1. The POST /two-factor endpoint does not implement rate limiting, lockout, or attempt counting, enabling attackers with valid credentials to brute-force TOTP codes within the configured window. Successful guessing results in a fully authenticated session. Furthermore, when two-factor authentication is enabled, it can be disabled without OTP re-verification through POST /account/profile unless required mode 2 is enforced. Administrators can reset other users' two-factor secrets via POST /api/v1/users/two_factor_reset. The issue is resolved in version 8.6.1.

An attacker with valid credentials can brute-force TOTP codes without restriction, potentially bypassing two-factor authentication and gaining full session access. The ability to disable two-factor authentication without OTP verification (unless required mode 2 is enabled) further weakens account security. Administrator capability to reset other users' two-factor secrets could be abused to compromise accounts. The vulnerability impacts confidentiality and integrity but not availability.

Upgrade Snipe-IT to version 8.6.1 or later, where this vulnerability is fixed. The vendor advisory confirms the issue is resolved in 8.6.1. Until upgrading, enforce required mode 2 for two-factor authentication to prevent disabling without OTP verification. Monitor administrative actions related to two-factor resets. Patch status is confirmed fixed in 8.6.1.