MRBS · CVE-2026-129132 · Package
NO FIX YET · SEE WHAT TO DO
MRBS (Meeting Room Booking System) builds LDAP search filters from raw login usernames without escaping them. A user with valid directory credentials but outside the required group can submit a crafted username that makes the group check always true and gain access.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Installations of MRBS that authenticate users against LDAP and use group membership to restrict access. An attacker needs a valid directory account that is outside the required group. Installations using other auth methods are not described as affected by the sources.
Not affected if mrbs-1.13.0-or-later, non-ldap-auth
Who cares ldap, mrbs, self-hosted
web/lib/MRBS/Auth/AuthLdap.php and compare it with 1.13.0unknown if the sources do not name the setting)1.13.0 or laterMRBS before 1.13.0 contains an LDAP injection vulnerability in web/lib/MRBS/Auth/AuthLdap.php that interpolates unescaped login usernames into DN search and group-membership filters. Attackers with valid directory credentials outside the required group can submit crafted usernames that make the group filter always true, bypassing access restrictions.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.