CVE-2025-15602

The record

Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By changing the email address of the Super Admin and triggering a password reset, an attacker can fully take over the Super Admin account, resulting in complete administrative control of the Snipe-IT instance.

Affected packages

Related vulnerabilities

• GHSA-4g25-wj72-chxg Snipe-IT allows stored XSS via the Locations "Country" field Also affects snipe/snipe-it
• CVE-2025-65622 Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a… Also affects snipe/snipe-it
• GHSA-fww5-m9wc-jcjc Snipe-IT is vulnerable to stored cross-site scripting Also affects snipe/snipe-it
• CVE-2025-65621 Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to… Also affects snipe/snipe-it
• GHSA-8x9v-8qgj-945x Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow Also affects snipe/snipe-it
• CVE-2025-64027 Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow Also affects snipe/snipe-it
• CVE-2026-96378 Improperly Controlled Modification of Dynamically-Determined Object Attributes… CWE-915
• CVE-2026-84645 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing… CWE-915