CVE-2025-15602 Details
Description
Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By changing the email address of the Super Admin and triggering a password reset, an attacker can fully take over the Super Admin account, resulting in complete administrative control of the Snipe-IT instance.
A mass assignment vulnerability allowing privilege escalation has been identified in Snipe-IT versions prior to 8.3.7. This vulnerability arises from sensitive user attributes related to account privileges being inadequately protected, enabling an authenticated, low-privileged user to manipulate restricted fields of another user's account via a crafted API request. Notably, this includes the ability to alter the Super Admin account. By changing the Super Admin's email address and initiating a password reset, an attacker can gain full control over the Super Admin account, thereby acquiring complete administrative rights within the Snipe-IT instance.
Users are advised to upgrade to Snipe-IT version 8.3.7 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/grokability/snipe-it/releases/tag/v8.3.7 | [email protected] | ProductRelease Notes |
| https://snipeitapp.com/ | [email protected] | Product |
| https://www.vulncheck.com/advisories/snipe-it-mass-assignment-vulnerability-leading-to-privilege-escalation | [email protected] | PatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| snipeitapp snipe-it | < 8.3.7 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 17, 2026 | Initial Analysis | [email protected] |
| Mar 6, 2026 | New CVE Received | [email protected] |