A critical mass assignment vulnerability in Snipe-IT allows low-privileged authenticated users to escalate their access to full administrative control over the application.

This vulnerability, categorized as CWE-915, occurs because sensitive user attributes are insufficiently protected against mass assignment. An authenticated, low-privileged attacker can craft a malicious API request to modify restricted fields, such as the email address of a Super Admin, to facilitate a full account takeover.

The ability for a low-privileged user to achieve full administrative control poses a severe risk to the confidentiality, integrity, and availability of the entire Snipe-IT instance. Successful exploitation permits an attacker to access sensitive asset data, modify system configurations, and perform unauthorized administrative actions. Given the CVSS score of 8.8, this flaw represents a high-severity threat that necessitates immediate remediation to prevent complete system compromise.

Immediate Action: Update Snipe-IT to version 8.3.7 or later to implement the necessary attribute protection fixes.

Proactive Monitoring: Review API access logs for anomalous requests, specifically targeting user update endpoints or unusual modifications to administrative account profiles.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block suspicious API payloads that attempt to modify restricted user attributes.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub (https://github.com/Nxvh1337/CVE-2025-15602-PoC).

The risk of total administrative takeover via this mass assignment flaw is significant for any organization utilizing Snipe-IT. Security teams should prioritize updating to version 8.3.7 immediately. Do not rely solely on access controls, as this vulnerability specifically targets the trust placed in API request parameters.