{"action":"Upgrade snipe/snipe-it to 8.3.7 or later.","affected":[{"fixed":"8.3.7","introduced":"0"}],"component":"snipe/snipe-it","cve_ids":["CVE-2025-15602"],"ecosystem":"Packagist","epss":0.00523,"exploited":false,"fixed_versions":["8.3.7"],"ghsa_id":"GHSA-5448-v74m-7mv7","id":"tcs_01M5KEVJE1HF9TH556YGZ4P40E","modified_at":"2026-03-07T02:56:18.620337Z","published_at":"2026-03-06T18:31:13Z","references":["https://osv.dev/vulnerability/GHSA-5448-v74m-7mv7","https://nvd.nist.gov/vuln/detail/CVE-2025-15602","https://github.com/grokability/snipe-it","https://github.com/grokability/snipe-it/releases/tag/v8.3.7","https://snipeitapp.com","https://www.vulncheck.com/advisories/snipe-it-mass-assignment-vulnerability-leading-to-privilege-escalation"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-5448-v74m-7mv7","url":"https://osv.dev/vulnerability/GHSA-5448-v74m-7mv7"}],"summary":"Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment"}