CVE-2025-66385
BaseFortify
Publication date: 2025-11-28
Last updated on: 2025-11-28
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cerebrate | cerebrate | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-472 | The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Cerebrate before version 1.30 allows an authenticated user who does not have privileged access to escalate their privileges. Specifically, by using the UsersController::edit endpoint and modifying the role_id or organisation_id fields in the edit request, a non-privileged user can obtain a higher role such as admin.
How can this vulnerability impact me? :
The vulnerability can allow an attacker who already has some access to the system to escalate their privileges to a higher level, such as an administrator. This can lead to unauthorized access to sensitive data, modification of system settings, or other malicious activities that compromise the security and integrity of the system.