{"id":"CVE-2026-125364","kind":"vulnerability","aliases":["CVE-2026-125364"],"related":[],"title":"frab: crew users can grant themselves organizer roles on any conference","description":"frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant themselves orga roles by submitting unchecked nested conference_users_attributes. Attackers can abuse UsersController#update or #create, which skip filter_conference_users, to gain orga on any conference and fully manage its events, schedule, reviewers and crew.","summary":"frab, a conference planning application, lets an authenticated crew user submit nested conference user attributes that are not checked. A crew member can grant themselves the orga role on any conference and then manage its events, schedule, reviewers and crew.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frab","package","rails","ruby","self-hosted"],"not_affected_if":["no-crew-users"],"how_to_check":"- Check the installed frab version; the sources say versions through 0.9.1 are affected.\n- Review whether crew accounts can reach the user create and update endpoints in the application.","fix":"- Move to a frab release later than `0.9.1`; the sources do not name the fixed version.","status":"open","published_at":"2026-11-10T00:17:08+00:00","first_seen_at":"2026-11-10T00:28:42+00:00","triaged_at":"2026-11-10T00:29:50+00:00","updated_at":"2026-11-10T00:29:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-10T00:29:50Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a frab release later than `0.9.1`; the sources do not name the fixed version.","reach":"network","title":"frab: crew users can grant themselves organizer roles on any conference","impact":"medium","summary":"frab, a conference planning application, lets an authenticated crew user submit nested conference user attributes that are not checked. A crew member can grant themselves the orga role on any conference and then manage its events, schedule, reviewers and crew.","audience":"businesses","category":"package","nicknames":[],"who_cares":["frab","self-hosted","ruby","rails"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"crew user becomes organizer on any conference, controlling its data","analyst_note":"Confirm the fixed frab version from the patch link on github.com and the vulncheck advisory; the sources here do not name it.","how_to_check":"- Check the installed frab version; the sources say versions through 0.9.1 are affected.\n- Review whether crew accounts can reach the user create and update endpoints in the application.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-crew-users"],"who_is_affected":"Teams running frab for conference management where crew accounts exist. The flaw sits in the user update and create paths (UsersController#update and #create), which skip the filter that should restrict nested conference user attributes. Instances with no crew accounts, or with only trusted crew, carry less risk, but the sources do not say more.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000732,"input_tokens":4608,"output_tokens":543,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125364':14A,17A '-2026':13A,16A '0.9.1':67C 'abus':92C 'allow':74C 'applic':29B 'attack':90C 'attribut':39B,89C 'authent':32B,75C 'check':43B 'confer':11A,27B,37B,55B,87C,100C,107C 'contain':68C 'creat':96C 'crew':2A,33B,45B,64B,76C,116C 'cve':12A,15A 'escal':71C 'event':60B,112C 'filter':99C 'frab':1A,18B,25B,65C 'fulli':109C 'gain':103C 'grant':5A,48B,79C 'host':24B 'let':30B 'manag':58B,110C 'member':46B 'nest':36B,86C 'orga':51B,81C,104C 'organ':7A 'packag':19B 'plan':28B 'privileg':70C 'rail':20B 'review':62B,114C 'role':8A,52B,82C 'rubi':21B 'schedul':61B,113C 'self':23B 'self-host':22B 'skip':98C 'submit':35B,84C 'uncheck':85C 'updat':94C 'user':3A,34B,38B,77C,88C,101C 'userscontrol':93C 'vulner':72C","nicknames":[],"mitigations":[],"who_affected":"Teams running frab for conference management where crew accounts exist. The flaw sits in the user update and create paths (UsersController#update and #create), which skip the filter that should restrict nested conference user attributes. Instances with no crew accounts, or with only trusted crew, carry less risk, but the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["frab","high","package","rails","ruby","selfhosted"],"campaign_type":null,"search_a":"'-125364':14A,17A '-2026':13A,16A 'confer':11A 'crew':2A 'cve':12A,15A 'frab':1A 'grant':5A 'organ':7A 'role':8A 'user':3A","search_b":"'applic':29B 'attribut':39B 'authent':32B 'check':43B 'confer':27B,37B,55B 'crew':33B,45B,64B 'event':60B 'frab':18B,25B 'grant':48B 'host':24B 'let':30B 'manag':58B 'member':46B 'nest':36B 'orga':51B 'packag':19B 'plan':28B 'rail':20B 'review':62B 'role':52B 'rubi':21B 'schedul':61B 'self':23B 'self-host':22B 'submit':35B 'user':34B,38B","search_c":"'0.9.1':67C 'abus':92C 'allow':74C 'attack':90C 'attribut':89C 'authent':75C 'confer':87C,100C,107C 'contain':68C 'creat':96C 'crew':76C,116C 'escal':71C 'event':112C 'filter':99C 'frab':65C 'fulli':109C 'gain':103C 'grant':79C 'manag':110C 'nest':86C 'orga':81C,104C 'privileg':70C 'review':114C 'role':82C 'schedul':113C 'skip':98C 'submit':84C 'uncheck':85C 'updat':94C 'user':77C,88C,101C 'userscontrol':93C 'vulner':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125364","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125364","severity":null,"published_at":"2026-11-10T00:17:08+00:00","modified_at":"2026-11-10T00:17:08+00:00","first_seen_at":"2026-11-10T00:28:42+00:00","fetched_at":"2026-11-10T00:28:42+00:00","note":null}],"documents":[{"id":111508,"url":"https://github.com/frab/frab/commit/8d14d491ac73f2e19030e95a86b6575106270eeb","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111509,"url":"https://www.vulncheck.com/advisories/frab-through-0.9.1-privilege-escalation-via-conference-users-attributes-in-userscontroller","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}