CVE-2025-66385
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a higher role such as admin) via the user-edit endpoint by supplying or modifying role_id or organisation_id fields in the edit request.
Risk Assessment
Risk of privilege escalation by regular users, potentially leading to system takeover.
Recommendation
Immediately update Cerebrate to version 1.30 or later and enforce server-side access controls.
Other vulnerabilities in Cerebrate
See all- CVE-2026-53911Medium
Cerebrate before version 1.37 allowed the id primary key field to be supplied through request input during CRUD edit operations and certain custom entity patching flows. This enabled an authenticated attacker to craft edit requests that could modify unrelated records.
- CVE-2026-53901High
Cerebrate before version 1.37 contains a mass-assignment vulnerability in the generic CRUD add path. The add() function does not properly remove the 'id' field from input, allowing a user to set a custom identifier for a new object. This can lead to unauthorized creation of objects with chosen IDs, object spoofing, or identifier collisions.
Original NVD description (English source)
UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a higher role such as admin) via the user-edit endpoint by supplying or modifying role_id or organisation_id fields in the edit request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS