Vendor
An authenticated crew user in frab version 0.9.1 and earlier can escalate privileges to an organizer role by manipulating nested attributes in User controller requests.