Privilege Escalation in frab by tripped Auth Roles Manipulation

CVE-2026-125364

What is CVE-2026-125364?

The frab application versions up to 0.9.1 have a privilege escalation vulnerability that allows authenticated crew users to escalate their roles to 'orga'. This can be exploited through the UsersController's update or create methods, where the filter_conference_users mechanism is bypassed due to unchecked nested conference_users_attributes. As a result, attackers can gain full management capabilities over conferences, including events, schedules, reviewers, and crew assignments.

References