CVE-2026-49870

Katalog CVE

CVSS 5.9 · Medium EPSS 0,40%

Kerentanan Allocation of Resources Without Limits or Throttling pada snipeitapp snipe-it. Skor CVSS 3.1 5.9 (Medium) menurut github.com.

Deskripsi (NVD)

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker with valid credentials to submit unlimited TOTP guesses against the three accepted codes created by config/google2fa.php window=1. A successful guess creates a fully authenticated session. When two_factor_enabled is 1, POST /account/profile with two_factor_optin=0 can disable two-factor authentication without OTP reverification, while required mode 2 prevents that opt-out. An administrator can also use POST /api/v1/users/two_factor_reset to clear another user's secret. This issue is fixed in version 8.6.1.

Rincian

Terbit di NVD

19 Agustus 2026

Terakhir diubah

30 September 2026

Status NVD

Analyzed

CVSS 3.1

5.9 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/grokability/snipe-it/security/advisories/GHSA-mr8g-2mj4-pcq2 advisory vendor
• https://github.com/grokability/snipe-it/commit/46d5234fd73d5fb928af43eb67d3bf7643d53115 patch
• https://github.com/grokability/snipe-it/pull/19072 patch
• https://github.com/grokability/snipe-it/releases/tag/v8.6.1 release notes · patch