CVE-2026-125364 · Package
NO FIX YET · SEE WHAT TO DO
frab, a conference planning application, lets an authenticated crew user submit nested conference user attributes that are not checked. A crew member can grant themselves the orga role on any conference and then manage its events, schedule, reviewers and crew.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running frab for conference management where crew accounts exist. The flaw sits in the user update and create paths (UsersController#update and #create), which skip the filter that should restrict nested conference user attributes. Instances with no crew accounts, or with only trusted crew, carry less risk, but the sources do not say more.
Not affected if no-crew-users
Who cares frab, rails, ruby, self-hosted
0.9.1; the sources do not name the fixed version.frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant themselves orga roles by submitting unchecked nested conference_users_attributes. Attackers can abuse UsersController#update or #create, which skip filter_conference_users, to gain orga on any conference and fully manage its events, schedule, reviewers and crew.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.