cbcvebase.
CVE-2025-15602
published 2026-03-06

CVE-2025-15602: Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An…

PriorityP261high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.46%
36.5th percentile
Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By changing the email address of the Super Admin and triggering a password reset, an attacker can fully take over the Super Admin account, resulting in complete administrative control of the Snipe-IT instance.

Affected

3 ranges
VendorProductVersion rangeFixed in
grokability_incsnipe-it< 8.3.78.3.7
snipesnipe-it>= 0 < 8.3.78.3.7
snipeitappsnipe-it< 8.3.78.3.7

Detection & IOCsextracted from sources · hover to see the quote

  • →Monitor for authenticated API requests from low-privileged users that attempt to modify user account fields belonging to other users, particularly the Super Admin account (e.g., PATCH/PUT requests to user update endpoints with fields such as email, permissions, or role attributes) ↗
  • →Alert on password reset requests triggered for the Super Admin account, especially when preceded by a recent email address change on that account, as this is the attacker's privilege escalation chain ↗
  • ·Vulnerability affects Snipe-IT versions prior to 8.3.7 only; upgrade to 8.3.7 or later to remediate the mass assignment issue on sensitive user attributes ↗
  • ·The attack requires an authenticated session (low-privileged user); unauthenticated exploitation is not possible. Ensure strict API authentication controls and least-privilege access are enforced. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.