CVE Catalog
CVE-2025-66385
CriticalSummary
UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a higher role such as admin) via the user-edit endpoint by supplying or modifying role_id or organisation_id fields in the edit request.
Risk Assessment
Risk of privilege escalation by regular users, potentially leading to system takeover.
Recommendation
Immediately update Cerebrate to version 1.30 or later and enforce server-side access controls.
Original NVD description (English source)
UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a higher role such as admin) via the user-edit endpoint by supplying or modifying role_id or organisation_id fields in the edit request.