Cpe:2.3:a:frab:frab:*:*:*:*:*:*:*:*

An authenticated crew user in frab version 0.9.1 and earlier can escalate privileges to an organizer role by manipulating nested attributes in User controller requests.