frab: Privilege escalation via conference_users_attributes (CVE-2026-125364)

The frab conference management system through version 0.9.1 is vulnerable to a privilege escalation flaw. Authenticated users assigned the 'crew' role can exploit the 'conference_users_attributes' parameter within 'UsersController#update' or 'UsersController#create' actions to grant themselves 'orga' (organizer) roles. This occurs because the application fails to apply the 'filter_conference_users' validation to these requests, allowing the user to bypass standard authorization checks. Successful exploitation grants the attacker full management capabilities over events, schedules, reviewers, and crew members for the targeted conference.

Impact

A successful exploit allows an authenticated 'crew' user to gain unauthorized administrative privileges over any conference within the installation. This leads to full administrative control, including the ability to delete or modify events, alter schedules, and manage sensitive reviewer data.

Recommendation

1. Inventory all instances of frab in the environment to confirm versioning.
2. Upgrade all instances to a version later than 0.9.1 when a vendor patch is available.
3. Until a patch is applied, implement strict access controls on the 'UsersController#update' and 'UsersController#create' endpoints for any user currently possessing the 'crew' role.