6 matches found
EUVD-2026-120527
frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant themselves orga roles by submitting unchecked nested conferenceusersattributes. Attackers can abuse UsersControllerupdate or create, which skip filterconferenceusers, to gain orga on any...
CVE-2026-125364
frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant themselves orga roles by submitting unchecked nested conferenceusersattributes. Attackers can abuse UsersControllerupdate or create, which skip filterconferenceusers, to gain orga on any...
CVE-2026-125364: frab: frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant…
frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant themselves orga roles by submitting unchecked nested conferenceusersattributes. Attackers can abuse UsersControllerupdate or create, which skip filterconferenceusers, to gain orga on any...
CVE-2026-125364 frab through 0.9.1 Privilege Escalation via conference_users_attributes in UsersController
frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant themselves orga roles by submitting unchecked nested conferenceusersattributes. Attackers can abuse UsersControllerupdate or create, which skip filterconferenceusers, to gain orga on any...
CVE-2026-125364
The frab software (through version 0.9.1 ) is susceptible to a privilege escalation vulnerability. Authenticated crew users can grant themselves orga roles by submitting unchecked nested conference_users_attributes. This is possible because the UsersController#update and #create actions skip the ...
PT-2026-141187
frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant themselves orga roles by submitting unchecked nested conference users attributes. Attackers can abuse UsersControllerupdate or create, which skip filter conference users, to gain orga on...