{"id":"CVE-2026-129132","kind":"vulnerability","aliases":["CVE-2026-129132"],"related":[],"title":"MRBS: LDAP login filter lets crafted usernames bypass group restrictions","description":"MRBS before 1.13.0 contains an LDAP injection vulnerability in web/lib/MRBS/Auth/AuthLdap.php that interpolates unescaped login usernames into DN search and group-membership filters. Attackers with valid directory credentials outside the required group can submit crafted usernames that make the group filter always true, bypassing access restrictions.","summary":"MRBS (Meeting Room Booking System) builds LDAP search filters from raw login usernames without escaping them. A user with valid directory credentials but outside the required group can submit a crafted username that makes the group check always true and gain access.","severity":"medium","cvss":4.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MRBS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ldap","mrbs","package","self-hosted"],"not_affected_if":["mrbs-1.13.0-or-later","non-ldap-auth"],"how_to_check":"- Check the installed MRBS version in the release files or `web/lib/MRBS/Auth/AuthLdap.php` and compare it with `1.13.0`\n- Confirm LDAP authentication is enabled in the MRBS configuration (`unknown` if the sources do not name the setting)","fix":"- MRBS: upgrade to `1.13.0` or later","status":"open","published_at":"2026-11-13T17:17:31+00:00","first_seen_at":"2026-11-13T17:48:01+00:00","triaged_at":"2026-11-13T17:49:10+00:00","updated_at":"2026-11-13T17:49:10+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T17:49:10Z","model":"claude-haiku-5-5","output":{"fix":"- MRBS: upgrade to `1.13.0` or later","reach":"network","title":"MRBS: LDAP login filter lets crafted usernames bypass group restrictions","impact":"medium","summary":"MRBS (Meeting Room Booking System) builds LDAP search filters from raw login usernames without escaping them. A user with valid directory credentials but outside the required group can submit a crafted username that makes the group check always true and gain access.","audience":"businesses","category":"package","nicknames":[],"who_cares":["mrbs","ldap","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Unauthorized users gain access to restricted booking functions","analyst_note":"Confirm the fixed version and the exact LDAP configuration needed to exploit, using the linked patch and release notes on github.com.","how_to_check":"- Check the installed MRBS version in the release files or `web/lib/MRBS/Auth/AuthLdap.php` and compare it with `1.13.0`\n- Confirm LDAP authentication is enabled in the MRBS configuration (`unknown` if the sources do not name the setting)","plain_action":"","product_name":"MRBS","needs_analyst":true,"not_affected_if":["non-ldap-auth","mrbs-1.13.0-or-later"],"who_is_affected":"Installations of MRBS that authenticate users against LDAP and use group membership to restrict access. An attacker needs a valid directory account that is outside the required group. Installations using other auth methods are not described as affected by the sources.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000761,"input_tokens":4656,"output_tokens":591,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129132':13A,16A '-2026':12A,15A '1.13.0':68C 'access':65B,110C 'alway':61B,107C 'attack':89C 'book':27B 'build':29B 'bypass':8A,109C 'check':60B 'contain':69C 'craft':6A,54B,100C 'credenti':45B,93C 'cve':11A,14A 'directori':44B,92C 'dn':82C 'escap':38B 'filter':4A,32B,88C,106C 'gain':64B 'group':9A,50B,59B,86C,97C,105C 'group-membership':85C 'host':23B 'inject':72C 'interpol':77C 'ldap':2A,18B,30B,71C 'let':5A 'login':3A,35B,79C 'make':57B,103C 'meet':25B 'membership':87C 'mrbs':1A,17A,19B,24B,66C 'outsid':47B,94C 'packag':20B 'raw':34B 'requir':49B,96C 'restrict':10A,111C 'room':26B 'search':31B,83C 'self':22B 'self-host':21B 'submit':52B,99C 'system':28B 'true':62B,108C 'unescap':78C 'user':41B 'usernam':7A,36B,55B,80C,101C 'valid':43B,91C 'vulner':73C 'web/lib/mrbs/auth/authldap.php':75C 'without':37B","nicknames":[],"mitigations":[],"who_affected":"Installations of MRBS that authenticate users against LDAP and use group membership to restrict access. An attacker needs a valid directory account that is outside the required group. Installations using other auth methods are not described as affected by the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["mrbs"],"ptokens":["mrbs"],"labels":["ldap","medium","mrbs","package","selfhosted","vendor"],"campaign_type":null,"search_a":"'-129132':13A,16A '-2026':12A,15A 'bypass':8A 'craft':6A 'cve':11A,14A 'filter':4A 'group':9A 'ldap':2A 'let':5A 'login':3A 'mrbs':1A,17A 'restrict':10A 'usernam':7A","search_b":"'access':65B 'alway':61B 'book':27B 'build':29B 'check':60B 'craft':54B 'credenti':45B 'directori':44B 'escap':38B 'filter':32B 'gain':64B 'group':50B,59B 'host':23B 'ldap':18B,30B 'login':35B 'make':57B 'meet':25B 'mrbs':19B,24B 'outsid':47B 'packag':20B 'raw':34B 'requir':49B 'room':26B 'search':31B 'self':22B 'self-host':21B 'submit':52B 'system':28B 'true':62B 'user':41B 'usernam':36B,55B 'valid':43B 'without':37B","search_c":"'1.13.0':68C 'access':110C 'alway':107C 'attack':89C 'bypass':109C 'contain':69C 'craft':100C 'credenti':93C 'directori':92C 'dn':82C 'filter':88C,106C 'group':86C,97C,105C 'group-membership':85C 'inject':72C 'interpol':77C 'ldap':71C 'login':79C 'make':103C 'membership':87C 'mrbs':66C 'outsid':94C 'requir':96C 'restrict':111C 'search':83C 'submit':99C 'true':108C 'unescap':78C 'usernam':80C,101C 'valid':91C 'vulner':73C 'web/lib/mrbs/auth/authldap.php':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T19:06:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129132","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129132","severity":null,"published_at":"2026-11-13T17:17:31+00:00","modified_at":"2026-11-13T17:17:31+00:00","first_seen_at":"2026-11-13T17:48:01+00:00","fetched_at":"2026-11-13T17:48:01+00:00","note":null}],"documents":[{"id":148137,"url":"https://github.com/meeting-room-booking-system/mrbs-code/commit/92f6f5610072ddb9e1b38074c410fc8be56947ed","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":148138,"url":"https://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.13.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":148139,"url":"https://github.com/meeting-room-booking-system/mrbs-code/security/advisories/GHSA-r543-f38c-cq6v","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-12T19:06:45+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":148140,"url":"https://www.vulncheck.com/advisories/mrbs-before-1.13.0-ldap-injection-via-authldap-php-authentication-filter","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}