Cerebrate up to 1.29 UsersController::edit organisation_id external control of assumed-immutable web parameter

Summaryinfo

A vulnerability classified as problematic was found in Cerebrate up to 1.29. The affected element is the function UsersController::edit. Such manipulation of the argument organisation_id leads to external control of assumed-immutable web parameter. This vulnerability is documented as CVE-2025-66385. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Cerebrate up to 1.29. It has been rated as problematic. Affected by this issue is the function UsersController::edit. The manipulation of the argument organisation_id with an unknown input leads to a external control of assumed-immutable web parameter vulnerability. Using CWE to declare the problem leads to CWE-472. The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields. Impacted is confidentiality, integrity, and availability. CVE summarizes:

UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a higher role such as admin) via the user-edit endpoint by supplying or modifying role_id or organisation_id fields in the edit request.

The advisory is available at github.com. This vulnerability is handled as CVE-2025-66385 since 11/28/2025. The exploitation is known to be easy. The attack may be launched remotely. The exploitation needs additional levels of successful authentication. Technical details are known, but there is no available exploit.

Upgrading to version 1.30 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch c9bfa90abc85d4a20a9cc2f282959b72bef829bb is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-199868). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Cerebrate

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion