Critical severityOSV Advisory· Published Nov 28, 2025· Updated Apr 15, 2026
CVE-2025-66385
CVE-2025-66385
Description
UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a higher role such as admin) via the user-edit endpoint by supplying or modifying role_id or organisation_id fields in the edit request.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2v0.1, v0.2, v1.28, …+ 1 more
- (no CPE)range: v0.1, v0.2, v1.28, …
- (no CPE)range: <1.30
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.