Critical severityOSV Advisory· Published Nov 28, 2025· Updated Apr 15, 2026
CVE-2025-66385
CVE-2025-66385
Description
UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a higher role such as admin) via the user-edit endpoint by supplying or modifying role_id or organisation_id fields in the edit request.
Affected products
1- Range: v0.1, v0.2, v1.28, …
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3News mentions
0No linked articles in our index yet.