CVE-2025-66385 Details
Description
UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a higher role such as admin) via the user-edit endpoint by supplying or modifying role_id or organisation_id fields in the edit request.
A privilege escalation vulnerability exists in the Cerebrate application, specifically in the UsersController's edit method, prior to version 1.30. This vulnerability allows authenticated, non-privileged users to escalate their privileges by manipulating the role_id or organisation_id fields in the edit request. As a result, these users could potentially gain access to higher roles, such as admin.
Users can update to Cerebrate version 1.30 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 28, 2025CISA-ADP
Assessed Nov 28, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cerebrate-project/cerebrate/commit/c9bfa90abc85d4a20a9cc2f282959b72bef829bb | [email protected] | Source CodeVendor |
| https://github.com/cerebrate-project/cerebrate/compare/v1.29...v1.30 | [email protected] | Release NotesVendor |
| https://vulnerability.circl.lu/api/vulnerability/gcve-1-2025-0017 | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-472 | External Control of Assumed-Immutable Web Parameter | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Cerebrate | < 1.30 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 28, 2025 | New CVE Received | [email protected] |