CVE-2025-15602: Snipe-IT Privilege Escalation Vulnerability

CVE-2025-15602 Overview

CVE-2025-15602 is a mass assignment vulnerability affecting Snipe-IT, a popular open-source IT asset management system. Versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment attacks. This vulnerability allows an authenticated, low-privileged user to craft malicious API requests to modify restricted fields of other user accounts, including the Super Admin account.

The attack chain is straightforward: by changing the email address of the Super Admin account through the vulnerable API endpoint and subsequently triggering a password reset, an attacker can fully compromise the Super Admin account. This results in complete administrative control of the Snipe-IT instance, potentially exposing all managed IT assets, license information, and organizational data.

Critical Impact

An authenticated low-privileged user can escalate to Super Admin privileges by exploiting mass assignment to hijack the Super Admin account via email address modification and password reset, leading to complete administrative takeover of the Snipe-IT instance.

Affected Products

• Snipe-IT versions prior to 8.3.7

Discovery Timeline

• 2026-03-06 - CVE-2025-15602 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2025-15602

Vulnerability Analysis

This vulnerability falls under CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), commonly known as mass assignment. In the context of Snipe-IT, the application fails to properly restrict which user model attributes can be modified through API requests.

Mass assignment vulnerabilities occur when an application automatically binds HTTP request parameters to internal object properties without proper filtering. In this case, Snipe-IT's user update functionality does not adequately protect sensitive fields such as email addresses, permission levels, and administrative flags from unauthorized modification by low-privileged authenticated users.

The vulnerability is network-accessible and requires low privileges to exploit, meaning any authenticated user with basic API access can potentially leverage this flaw. No user interaction is required from the victim, making this a particularly dangerous attack vector for insider threats or compromised low-privilege accounts.

Root Cause

The root cause lies in insufficient input validation and attribute filtering within Snipe-IT's user management API endpoints. The application fails to implement proper allowlist controls that would restrict which user model attributes can be modified based on the requester's privilege level.

When processing API requests to update user records, the application does not adequately verify whether the requesting user has authorization to modify specific sensitive fields. This allows low-privileged users to include restricted attributes in their API payloads, which are then blindly applied to the target user object.

Attack Vector

The attack exploits the network-accessible API endpoints in Snipe-IT. An attacker with valid low-level credentials follows this exploitation path:

1. Authentication: The attacker authenticates to Snipe-IT with a low-privileged user account
2. Target Identification: The attacker identifies the Super Admin account or another high-privilege account
3. Mass Assignment Attack: The attacker crafts a malicious API request to the user update endpoint, including the target user's ID and a modified email address field pointing to an attacker-controlled email
4. Password Reset Trigger: After successfully modifying the Super Admin's email address, the attacker initiates a password reset request
5. Account Takeover: The password reset email is sent to the attacker-controlled address, allowing them to set a new password and gain complete administrative access

This attack requires no special tools beyond standard API interaction capabilities and can be executed with minimal technical sophistication once the vulnerable endpoint is identified.

Detection Methods for CVE-2025-15602

Indicators of Compromise

• Unexpected changes to Super Admin or high-privilege user email addresses in Snipe-IT audit logs
• Password reset requests for administrative accounts originating from unusual sources or timeframes
• API requests from low-privileged users attempting to modify other users' account attributes
• Sudden changes in user permissions or role assignments without corresponding administrative activity

Detection Strategies

• Monitor Snipe-IT API access logs for user update requests that modify email addresses or permission-related fields
• Implement alerting on password reset requests for administrative accounts, especially following recent profile modifications
• Review audit trails for any modifications to Super Admin accounts by non-administrative users
• Deploy application-layer monitoring to detect anomalous API parameter patterns in user update requests

Monitoring Recommendations

• Enable comprehensive audit logging within Snipe-IT to capture all user modification events
• Configure SIEM rules to correlate user profile changes with subsequent password reset activities
• Establish baseline behavior for API usage patterns and alert on deviations, particularly for user management endpoints
• Implement real-time monitoring of administrative account modifications with immediate alerting

How to Mitigate CVE-2025-15602

Immediate Actions Required

• Upgrade Snipe-IT to version 8.3.7 or later immediately to address this vulnerability
• Review Snipe-IT audit logs for any evidence of unauthorized user modifications, particularly to administrative accounts
• Verify the integrity of all Super Admin and high-privilege user account details, including email addresses
• Rotate credentials for any administrative accounts that may have been compromised
• Restrict API access to trusted networks until the patch is applied

Patch Information

The vulnerability has been addressed in Snipe-IT version 8.3.7. Organizations should upgrade to this version or later by following the official upgrade documentation. The release notes and download are available at the GitHub Release v8.3.7. Additional information about Snipe-IT can be found on the Snipe-IT Official Website. For detailed vulnerability information, refer to the VulnCheck Advisory on Snipe-IT.

Workarounds

• Implement network-level access controls to restrict API access to trusted IP addresses only
• Disable or limit API access for low-privileged users until the patch can be applied
• Enable additional authentication requirements such as MFA for all administrative accounts
• Consider implementing a web application firewall (WAF) with rules to filter suspicious API parameters targeting user modification endpoints

# Configuration example
# Restrict Snipe-IT API access at the web server level (nginx example)
# Add to your Snipe-IT nginx configuration

location /api/ {
    # Allow only trusted internal networks
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    
    # Standard proxy configuration
    try_files $uri $uri/ /index.php?$query_string;
}