CVE-2025-15602

Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By changing the email address of the Super Admin and triggering a password reset, an attacker can fully take over the Super Admin account, resulting in complete administrative control of the Snipe-IT instance.

• CWE-915

• https://github.com/grokability/snipe-it/releases/tag/v8.3.7Product, Release Notes
• https://snipeitapp.com/Product
• https://www.vulncheck.com/advisories/snipe-it-mass-assignment-vulnerability-leading-to-privilege-escalationPatch, Third Party Advisory

Published

Mar 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-1559The CC-IMG-Shortcode plugin for WordPress is vulnerable to S…6.4
• CVE-2025-15595Privilege escalation via dll hijacking in Inno Setup 6.2.1 a…7.8
• CVE-2025-15597A vulnerability has been found in Dataease SQLBot up to 1.4.…6.3
• CVE-2025-15598A vulnerability was found in Dataease SQLBot up to 1.5.1. Th…5.9
• CVE-2025-15599DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contai…6.1
• CVE-2025-1560The WOW Entrance Effects (WEE!) plugin for WordPress is vuln…5.4
• CVE-2025-15603Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2025-15604Amon2 versions before 6.17 for Perl use an insecure random_s…9.8
• CVE-2025-15605A hardcoded cryptographic key within the configuration mecha…7.3
• CVE-2025-15606A Denial-of-Service (DoS) vulnerability in the httpd compone…7.5
• CVE-2025-15607A command injection vulnerability on AX53 v1 occurs in mscd …9.8
• CVE-2025-15608This vulnerability in AX53 v1, AX55 v4 and AX55 v4.6 results…9.8