Cerebrate vulnerabilities

UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a higher role such as admin) via the user-edit endpoint by supplying or modifying role_id or organisation_id fields in the edit request.

Cerebrate before version 1.37 allowed the id primary key field to be supplied through request input during CRUD edit operations and certain custom entity patching flows. This enabled an authenticated attacker to craft edit requests that could modify unrelated records.

Cerebrate before version 1.37 contains a mass-assignment vulnerability in the generic CRUD add path. The add() function does not properly remove the 'id' field from input, allowing a user to set a custom identifier for a new object. This can lead to unauthorized creation of objects with chosen IDs, object spoofing, or identifier collisions.