LDAP Injection Vulnerability in MRBS by Meeting Room Booking System
CVE-2026-129132

2.3LOW

Key Information:

Vendor

Meeting-room-booking-system

Status
Mrbs-code
Vendor
CVE Published:
13 November 2026

What is CVE-2026-129132?

An LDAP injection vulnerability in MRBS prior to version 1.13.0 allows attackers with valid directory credentials to bypass access restrictions. By crafting specific usernames, an attacker can manipulate the DN search and group-membership filters, making the group filter always evaluate to true. This flaw is located in the AuthLdap.php module, enabling unauthorized access beyond the intended group limitations.

Affected Version(s)

mrbs-code 0 < 1.13.0

References

https://github.com/meeting-room-booking-system/mrbs-code/...
vendor-advisory
https://github.com/meeting-room-booking-system/mrbs-code/...
patch
https://github.com/meeting-room-booking-system/mrbs-code/...
release-notes

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153 from Viettel Post
John Beranek
.