EUVD-2026-120527

frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant themselves orga roles by submitting unchecked nested conferenceusersattributes. Attackers can abuse UsersControllerupdate or create, which skip filterconferenceusers, to gain orga on any...

CVE-2026-125364

frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant themselves orga roles by submitting unchecked nested conferenceusersattributes. Attackers can abuse UsersControllerupdate or create, which skip filterconferenceusers, to gain orga on any...

CVE-2026-125364: frab: frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant…

frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant themselves orga roles by submitting unchecked nested conferenceusersattributes. Attackers can abuse UsersControllerupdate or create, which skip filterconferenceusers, to gain orga on any...

CVE-2026-125364 frab through 0.9.1 Privilege Escalation via conference_users_attributes in UsersController

frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant themselves orga roles by submitting unchecked nested conferenceusersattributes. Attackers can abuse UsersControllerupdate or create, which skip filterconferenceusers, to gain orga on any...

CVE-2026-125364

The frab software (through version 0.9.1 ) is susceptible to a privilege escalation vulnerability. Authenticated crew users can grant themselves orga roles by submitting unchecked nested conference_users_attributes. This is possible because the UsersController#update and #create actions skip the ...