https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T18:27:26.877327+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-337060 EUVD-2026-337060 2026-10-10T18:27:26.879462+00:00 EUVD-2026-337060 https://cve.radiocsirt.org/vuln/fkie_cve-2025-15602 fkie_cve-2025-15602 2026-10-10T18:27:26.879495+00:00

Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By changing the email address of the Super Admin and triggering a password reset, an attacker can fully take over the Super Admin account, resulting in complete administrative control of the Snipe-IT instance.

 https://cve.radiocsirt.org/vuln/ghsa-5448-v74m-7mv7 GHSA-5448-v74m-7mv7 — Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass ass… 2026-10-10T18:27:26.879528+00:00

Affected: Packagist: snipe/snipe-it

Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By changing the email address of the Super Admin and triggering a password reset, an attacker can fully take over the Super Admin account, resulting in complete administrative control of the Snipe-IT instance.