Executive Summary

[{'type': 'paragraph', 'content': "CVE-2025-15602 is a mass assignment vulnerability in Snipe-IT versions prior to 8.3.7. It occurs because sensitive user attributes related to account privileges are not sufficiently protected. This allows an authenticated user with low privileges to craft a malicious API request that modifies restricted fields of another user's account, including the Super Admin account."}, {'type': 'paragraph', 'content': "By changing the Super Admin's email address and triggering a password reset, an attacker can take full control of the Super Admin account, gaining complete administrative access to the Snipe-IT instance."}] [2]

Useful 0 Not Useful 0

Impact Analysis

[{'type': 'paragraph', 'content': "This vulnerability can lead to a complete takeover of the Snipe-IT instance by an attacker. Specifically, an attacker with low privileges can escalate their access by modifying the Super Admin account's email address and resetting its password."}, {'type': 'paragraph', 'content': 'As a result, the attacker gains full administrative control, which can lead to unauthorized access to sensitive data, modification or deletion of assets, and disruption of asset management operations.'}] [2]

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Snipe-IT to version 8.3.7 or later, as this version contains fixes addressing the mass assignment issue that allows privilege escalation.

Additionally, review and restrict API access permissions to ensure that low-privileged users cannot modify sensitive user attributes, especially those related to the Super Admin account.

Useful 0 Not Useful 0