CVE-2025-15602 - Vulnerability Analysis

Overview

Snipe-IT < 8.3.7 contains a broken access control caused by insufficient protection against mass assignment in user attributes, letting authenticated low-privileged users modify restricted fields and take over Super Admin accounts, exploit requires authentication.

Severity & Score

Impact

Low-privileged authenticated users can take over Super Admin accounts, gaining full administrative control of the Snipe-IT instance.

Mitigation

Upgrade to version 8.3.7 or later.

References

• https://www.vulncheck.com/advisories/snipe-it-mass-assignment-vulnerability-leading-to-privilege-escalation
• https://github.com/grokability/snipe-it/releases/tag/v8.3.7
• https://snipeitapp.com/

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 7, 2026

🟠 CVE-2025-15602 - High (8.8) Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricte... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-15602/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner