Is CVE-2026-49870 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49870 being exploited in the wild.

How severe is CVE-2026-49870?

Medium severity, with a CVSS score of 5.9, published 19 August 2026.

Which products and versions are affected?

snipe/snipe-it (Packagist) < 8.6.0, ECOSYSTEM:introduced=0,fixed=8.6.0.

Is there a fix for CVE-2026-49870?

Yes. snipe/snipe-it (Packagist): upgrade to 8.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49870 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-49870?

Check whether you run snipe/snipe-it (Packagist) or Snipeitapp Snipe-It at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49870: Snipe-IT TOTP brute force due to missing rate limiting in /two-factor

Q: Is there a fix for CVE-2026-49870?

Yes. snipe/snipe-it (Packagist): upgrade to 8.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-49870 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-49870?

Check whether you run snipe/snipe-it (Packagist) or Snipeitapp Snipe-It at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49870 · Severity: medium · CVSS 5.9 · Published 2026-08-19

Snipe-IT, an open-source asset management system, contains a flaw in its two-factor authentication (2FA) process. An attacker who already knows a user's password can repeatedly guess the secondary security code without being locked out. If successful, the attacker can gain full access to the account and, in some configurations, permanently disable the security feature for that user.

Technologies: snipe/snipe-it (Packagist), Snipeitapp Snipe-It. Vendors: Packagist, Snipeitapp.

Quick answers

Is CVE-2026-49870 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49870 being exploited in the wild.
How severe is CVE-2026-49870?: Medium severity, with a CVSS score of 5.9, published 19 August 2026.
Which products and versions are affected?: snipe/snipe-it (Packagist) < 8.6.0, ECOSYSTEM:introduced=0,fixed=8.6.0.
Is there a fix for CVE-2026-49870?: Yes. snipe/snipe-it (Packagist): upgrade to 8.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49870 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-49870?: Check whether you run snipe/snipe-it (Packagist) or Snipeitapp Snipe-It at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

snipe/snipe-it (Packagist): upgrade to 8.6.0 or later
```
composer require snipe/snipe-it:^8.6.0
```

Technical details

The `POST /two-factor` endpoint in Snipe-IT lacks rate limiting, lockout mechanisms, or attempt counters. This allows an attacker with valid primary credentials to perform a brute-force attack against the 6-digit TOTP code. Because the implementation accepts the current code plus one step on either side (a window of 3 valid codes out of 1,000,000), the probability of a successful guess is increased. Upon successful exploitation, the attacker gains a fully authenticated session. If 2FA is set to optional mode, the attacker can further disable 2FA via the profile settings without re-verification. Administrative accounts can also be targeted to reset other users' 2FA secrets via the API. This issue is resolved in version 8.6.0.

Affected products

grokability Snipe-IT < 8.6.0

Identifiers

CVE-2026-49870
GHSA-mr8g-2mj4-pcq2

Timeline

2026-06-08: disclosed
2026-06-23: advisory
2026-06-23: patched: Patched in v8.6.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.