{"affected":[{"defaultStatus":"unaffected","product":"frab","source":"CNA: VulnCheck","vendor":"frab","versions":[{"lessThanOrEqual":"0.9.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-125364","cwes":["CWE-269"],"description":"frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant themselves orga roles by submitting unchecked nested conference_users_attributes. Attackers can abuse UsersController#update or #create, which skip filter_conference_users, to gain orga on any conference and fully manage its events, schedule, reviewers and crew.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.6,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":8.1,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1794266857097,"publishedAt":1794266857097,"references":[{"source":"CNA: VulnCheck","tags":["issue-tracking"],"url":"https://github.com/frab/frab/issues/1053"},{"source":"CNA: VulnCheck","tags":["product"],"url":"https://github.com/frab/frab"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/frab/frab/blob/0.9.1/app/controllers/users_controller.rb#L51"},{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/frab/frab/commit/8d14d491ac73f2e19030e95a86b6575106270eeb"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/frab-through-0.9.1-privilege-escalation-via-conference-users-attributes-in-userscontroller"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/frab/frab/commit/8d14d491ac73f2e19030e95a86b6575106270eeb"}],"revision":"0ed69c3c6904db7b6dd7691f1bd112c98bed21f886c54c3ba28b30187f933319","sources":[{"modifiedAt":1794266857097,"name":"CNA: VulnCheck","retrievedAt":1794269326561,"url":"https://www.cve.org/CVERecord?id=CVE-2026-125364"}],"ssvc":null,"status":"published","title":"frab through 0.9.1 Privilege Escalation via conference_users_attributes in UsersController","updatedAt":1794269326561}