CVE-2025-15602 - Vulnerability Analysis

Overview

Snipe-IT < 8.3.7 contains a broken access control caused by insufficient protection against mass assignment in user attributes, letting authenticated low-privileged users modify restricted fields and take over Super Admin accounts, exploit requires authentication.

Severity & Score

Impact

Low-privileged authenticated users can take over Super Admin accounts, gaining full administrative control of the Snipe-IT instance.

Mitigation

Upgrade to version 8.3.7 or later.

References

• https://github.com/grokability/snipe-it/releases/tag/v8.3.7
• https://snipeitapp.com/
• https://www.vulncheck.com/advisories/snipe-it-mass-assignment-vulnerability-leading-to-privilege-escalation

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner