Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An a…

Snipe-IT versions prior to 8.3.7 contain a mass assignment vulnerability that allows authenticated low-privileged users to modify restricted user account fields via malicious API requests. Attackers can target the Super Admin account by changing its email address and triggering a password reset, leading to complete administrative takeover of the Snipe-IT instance. This vulnerability affects sensitive user attributes related to account privileges that lack proper protection.