CVE-2025-15602: Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment

CVE-2025-15602 · Severity: high · CVSS 8.8 · Published 2026-03-06

Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By changing the email address of the Super Admin and triggering a password reset, an attacker can fully take over the Super Admin account, resulting in complete administrative control of the Snipe-IT instance.

Technologies: snipe/snipe-it (Packagist), Snipeitapp Snipe-It. Vendors: Packagist, Snipeitapp.

Quick answers

Is CVE-2025-15602 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-15602 being exploited in the wild.
How severe is CVE-2025-15602?
High severity, with a CVSS score of 8.8, published 6 March 2026.
Which products and versions are affected?
snipe/snipe-it (Packagist) ECOSYSTEM:introduced=0,fixed=8.3.7.
Is there a fix for CVE-2025-15602?
Yes. snipe/snipe-it (Packagist): upgrade to 8.3.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2025-15602?
Check whether you run snipe/snipe-it (Packagist) or Snipeitapp Snipe-It at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • snipe/snipe-it (Packagist): upgrade to 8.3.7 or later
    composer require snipe/snipe-it:^8.3.7

Affected products

  • snipe/snipe-it (Packagist) ECOSYSTEM:introduced=0,fixed=8.3.7
  • Snipeitapp Snipe-It

Identifiers

  • CVE-2025-15602
  • GHSA-5448-v74m-7mv7

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.