CVE-2025-15602: 
PHP vulnerability analysis and mitigation

CVE-2025-15602 is a mass assignment vulnerability in Snipe-IT (an open-source IT asset management application) that allows an authenticated low-privileged user to take over the Super Admin account. All Snipe-IT versions prior to 8.3.7 are affected. The vulnerability was published on March 6, 2026, with a patch released in version 8.3.7. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.7 (High) (VulnCheck Advisory, Red Hat CVE).

The root cause is CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), commonly known as a mass assignment vulnerability. Snipe-IT's API fails to restrict which user attributes can be modified via API requests, allowing an authenticated low-privileged user to overwrite sensitive fields — including those belonging to the Super Admin account — by crafting a malicious API request with restricted parameters. The specific attack chain involves changing the Super Admin's email address via the API and then triggering a password reset to that attacker-controlled email, resulting in full account takeover. A public PoC repository has been published at https://github.com/Nxvh1337/CVE-2025-15602-PoC (VulnCheck Advisory, GitHub PoC).

Successful exploitation grants the attacker complete administrative control over the Snipe-IT instance, compromising confidentiality, integrity, and availability across the entire application. An attacker can view, modify, and delete any asset management data, user accounts, and system configurations. Because Snipe-IT manages IT asset inventories, a full admin compromise could expose sensitive organizational infrastructure data and enable further lateral movement within the enterprise (VulnCheck Advisory).

A public proof-of-concept exploit has been published on GitHub (Nxvh1337/CVE-2025-15602-PoC), though at initial disclosure there was no evidence of in-the-wild exploitation (Feedly Intelligence). The EPSS score is approximately 0.019% (0.000190), indicating a currently low probability of exploitation in the wild. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report. The low privilege requirement (any authenticated user) and network-accessible attack vector make this relatively easy to exploit once credentials are obtained (GitHub PoC, VulnCheck Advisory).

1. Reconnaissance: Identify a target Snipe-IT instance running a version prior to 8.3.7. Obtain or possess any valid low-privileged user account credentials.
2. Authenticate and obtain API token: Log in to the Snipe-IT instance and retrieve a personal API token from the user profile settings, or use existing API credentials.
3. Craft malicious API request: Send a PUT or PATCH API request to the user management endpoint (e.g., /api/v1/users/{super_admin_id}) with a JSON body that includes restricted fields such as email, targeting the Super Admin account's user ID.
4. Modify Super Admin email: The API processes the request without properly restricting the mass-assignable fields, updating the Super Admin's email address to one controlled by the attacker.
5. Trigger password reset: Use the Snipe-IT password reset functionality with the newly set attacker-controlled email address to receive a password reset link.
6. Complete account takeover: Follow the password reset link, set a new password, and log in as Super Admin, achieving full administrative control of the Snipe-IT instance (VulnCheck Advisory, GitHub PoC).

• Network: Unexpected PUT or PATCH API requests to /api/v1/users/{id} endpoints from low-privileged user tokens, particularly targeting user IDs associated with Super Admin accounts; API requests containing email or privilege-related fields in the request body from non-admin accounts.
• Logs: Snipe-IT application logs showing email address changes on the Super Admin account originating from a non-admin user's API token; password reset requests for the Super Admin account shortly after an email change event; audit log entries reflecting user attribute modifications by unexpected actors.
• Application Events: Super Admin account email changed to an external or unknown domain; password reset email sent to an unrecognized address; new Super Admin login from an unfamiliar IP address or user agent following a password reset.

Upgrade Snipe-IT to version 8.3.7 or later, which introduces a disallowed fields list for the users API endpoint (see PR #18303: "Update users api with disallowed fields list") (Snipe-IT v8.3.7 Release). As an interim workaround, restrict API access for low-privileged users at the network or application firewall level, and monitor API activity for suspicious requests attempting to modify user attributes — particularly those targeting Super Admin accounts. Review and audit recent API logs for any unauthorized email changes to privileged accounts (VulnCheck Advisory).

The Hacker Wire published a write-up on the vulnerability titled "Snipe-IT Mass Assignment Leads to Super Admin Takeover – CVE-2025-15602," which was also shared on Mastodon (The Hacker Wire). RedPacket Security flagged the CVE on social media shortly after disclosure. The vulnerability was tracked by ENISA's EUVD (EUVD-2025-208340) and noted by GitLab's advisory database. Community reaction has been moderate, consistent with a high-severity privilege escalation in a widely used open-source IT asset management tool.