CVE-2025-15602: CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes in Grokability, Inc. Snipe-IT
Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By changing the email address of the Super Admin and triggering a password reset, an attacker can fully take over the Super Admin account, resulting in complete administrative control of the Snipe-IT instance.
AI Analysis
Technical Summary
CVE-2025-15602 is an improper access control vulnerability (CWE-915) in Grokability, Inc.'s Snipe-IT product affecting versions before 8.3.7. The issue arises from insufficient protection against mass assignment of sensitive user attributes related to account privileges. An authenticated user with low privileges can craft malicious API requests to alter restricted fields of other user accounts, including the Super Admin account. By changing the Super Admin's email address and initiating a password reset, the attacker can take over the Super Admin account and gain complete administrative control over the Snipe-IT instance.
Potential Impact
An attacker with low-level authentication can escalate privileges to full administrative control by modifying the Super Admin account's email and resetting its password. This compromises the entire Snipe-IT instance, potentially exposing all managed assets and sensitive information.
Mitigation Recommendations
A fix is available in Snipe-IT version 8.3.7. Users should upgrade to version 8.3.7 or later to remediate this vulnerability. Since no official patch links are provided, verify the upgrade availability and instructions from the vendor's official channels before applying.
CVE-2025-15602: CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes in Grokability, Inc. Snipe-IT
Description
Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By changing the email address of the Super Admin and triggering a password reset, an attacker can fully take over the Super Admin account, resulting in complete administrative control of the Snipe-IT instance.
CVSS v4.0
Score 8.7high
Affected software
pkg:github/grokability/snipe-itRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-15602 is an improper access control vulnerability (CWE-915) in Grokability, Inc.'s Snipe-IT product affecting versions before 8.3.7. The issue arises from insufficient protection against mass assignment of sensitive user attributes related to account privileges. An authenticated user with low privileges can craft malicious API requests to alter restricted fields of other user accounts, including the Super Admin account. By changing the Super Admin's email address and initiating a password reset, the attacker can take over the Super Admin account and gain complete administrative control over the Snipe-IT instance.
Potential Impact
An attacker with low-level authentication can escalate privileges to full administrative control by modifying the Super Admin account's email and resetting its password. This compromises the entire Snipe-IT instance, potentially exposing all managed assets and sensitive information.
Mitigation Recommendations
A fix is available in Snipe-IT version 8.3.7. Users should upgrade to version 8.3.7 or later to remediate this vulnerability. Since no official patch links are provided, verify the upgrade availability and instructions from the vendor's official channels before applying.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-03-06T16:13:18.460Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 69ab014fc48b3f10ffac9b50
Added to database: 03/06/2026, 16:31:11 UTC
Last enriched: 07/15/2026, 09:49:03 UTC
Last updated: 07/31/2026, 19:22:53 UTC
Views: 308
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.