{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3afrabfrab/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:frab:frab:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-125364"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["frab (\u003c= 0.9.1)"],"_cs_severities":["high"],"_cs_tags":["web-application","privilege-escalation","authentication-bypass"],"_cs_type":"advisory","_cs_vendors":["frab"],"content_html":"\u003cp\u003eThe frab conference management system through version 0.9.1 is vulnerable to a privilege escalation flaw. Authenticated users assigned the 'crew' role can exploit the 'conference_users_attributes' parameter within 'UsersController#update' or 'UsersController#create' actions to grant themselves 'orga' (organizer) roles. This occurs because the application fails to apply the 'filter_conference_users' validation to these requests, allowing the user to bypass standard authorization checks. Successful exploitation grants the attacker full management capabilities over events, schedules, reviewers, and crew members for the targeted conference.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eA successful exploit allows an authenticated 'crew' user to gain unauthorized administrative privileges over any conference within the installation. This leads to full administrative control, including the ability to delete or modify events, alter schedules, and manage sensitive reviewer data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInventory all instances of frab in the environment to confirm versioning.\u003c/li\u003e\n\u003cli\u003eUpgrade all instances to a version later than 0.9.1 when a vendor patch is available.\u003c/li\u003e\n\u003cli\u003eUntil a patch is applied, implement strict access controls on the 'UsersController#update' and 'UsersController#create' endpoints for any user currently possessing the 'crew' role.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-11-10T02:04:25Z","date_published":"2026-11-10T02:04:25Z","id":"https://feed.craftedsignal.io/briefs/2026-11-frab-priv-esc/","summary":"An authenticated crew user in frab version 0.9.1 and earlier can escalate privileges to an organizer role by manipulating nested attributes in User controller requests.","title":"frab: Privilege escalation via conference_users_attributes (CVE-2026-125364)","url":"https://feed.craftedsignal.io/briefs/2026-11-frab-priv-esc/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:frab:frab:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}