PT-2025-48317 · Cerebrate · Cerebrate

Published 2025-11-28 · Updated 2025-12-01 · CVE-2025-66385

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Cerebrate versions prior to 1.30

Description The UsersController::edit function in Cerebrate allows an authenticated, non-privileged user to escalate their privileges, potentially obtaining a higher role such as administrator. This is achieved through the user-edit API endpoint by modifying the role id or organisation id parameters within the edit request. The role id and organisation id are vulnerable parameters.

Recommendations Versions prior to 1.30 should be updated. As a temporary workaround, restrict access to the user-edit API endpoint. Consider disabling the UsersController::edit function until a patch is available.

Fix

LPE

Weakness Enumeration

CWE-472

Related Identifiers

CVE-2025-66385

Affected Products

Cerebrate

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-66385 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66385 · Vendor Advisory
• https://github.com/cerebrate-project/cerebrate/commit/c9bfa90abc85d4a20a9cc2f282959b72bef829bb · Note
• https://github.com/cerebrate-project/cerebrate/compare/v1.29...v1.30 · Note
• https://twitter.com/0dayPublishing/status/1994302761773466040 · Twitter Post
• https://twitter.com/CVEnew/status/1994304558042943908 · Twitter Post
• https://twitter.com/CCBalert/status/1995512083757052011 · Twitter Post
• https://t.me/cveNotify/144209 · Telegram Post
• https://t.me/CVEtracker/38429 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1994316036661719053 · Twitter Post
• https://vulnerability.circl.lu/api/vulnerability/gcve-1-2025-0017 · Note