Loading...
Skip to main content
GeekWala

CVE-2025-15602

HIGH

Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment

Published March 6, 2026Updated March 7, 2026Source: osv

Summary

Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By changing the email address of the Super Admin and triggering a password reset, an attacker can fully take over the Super Admin account, resulting in complete administrative control of the Snipe-IT instance.

Remediation

Upgrade to the fixed version using your package manager.

Composer
Update snipe/snipe-it to 8.3.7 or later
composer require "snipe/snipe-it:^8.3.7"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

PackageEcosystemAffectedFixed In
snipe/snipe-it
packagist
3.2.0, v0.1.0, v0.1.1, v0.1.2 (+268 more)8.3.7

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2025-15602?
Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2025-15602?
CVE-2025-15602 affects snipe/snipe-it. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-15602 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.8

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-5448-v74m-7mv7

Related CVEs

  • CVE-2026-37709
    CRITICAL

    Snipe-IT has insecure permissions in file uploads

  • CVE-2026-64679
    HIGH

    Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation

  • CVE-2026-63135
    HIGH

    YOURLS has stored XSS in referrer statistics chart via crafted Referer header

  • CVE-2026-54178
    HIGH

    Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk

  • CVE-2026-44832
    HIGH

    Snipe-IT has Privilege Escalation via API Permissions Assignment

  • CVE-2026-54182
    HIGH

    Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

  • CVE-2026-54329
    HIGH

    Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection

  • CVE-2026-61807
    MEDIUM

    Snipe-IT: Stored DOM XSS via table selected-count IDs

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies