UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a higher role such as admin) via the user-edit endpoint by supplying or modifying role_id or organisation_id fields in the edit request.
The UsersController::edit function does not properly verify whether the user has permissions to modify fields such as role_id or organisation_id when editing their own profile. An authenticated user without administrative privileges can send a request to the user-edit endpoint with manually entered or modified values of these fields. As a result, the system processes the change without permission control, assigning the user a higher role or different organization. This is an example of CWE-472 vulnerability — insufficient control of externally accessible, critical query parameters.
An attacker with access to a regular user account can grant themselves an administrator role or change organizational affiliation, gaining full control over the Cerebrate instance and all data stored within it.
Cerebrate should be updated to version 1.30 or newer. The patch was introduced in commit c9bfa90abc85d4a20a9cc2f282959b72bef829bb available in the vendor's repository on GitHub.
Cerebrate in versions earlier than 1.30
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X