Vulnerabilities

TI-2025-40826 CVE-2025-66385 · GHSA-xh4p-6jqr-58x9

UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged…

MEDIUM 49

UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a higher role such as admin) via the user-edit endpoint by supplying or modifying role…

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.00451 Published 2025-11-28 Fixed in 1.30 CWE-472

TI-2023-22296 CVE-2023-41908 · GHSA-fm4p-m2rr-w83h

Cerebrate before 1.15 lacks the Secure attribute for the session cookie.

LOW 30

Cerebrate before 1.15 lacks the Secure attribute for the session cookie.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00431 Published 2023-09-05 No fix listed CWE-862

TI-2023-21960 CVE-2023-41363 · GHSA-69rq-g7gr-2r73

In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users…

LOW 20

In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00394 Published 2023-08-29 No fix listed

TI-2023-13384 CVE-2023-28883 · GHSA-9wmw-wg92-52h9

In Cerebrate 1.13, a blind SQL injection exists in the searchAll API endpoint.

MEDIUM 50

In Cerebrate 1.13, a blind SQL injection exists in the searchAll API endpoint.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00701 Published 2023-03-27 No fix listed CWE-89

TI-2023-11615 CVE-2023-26468 · GHSA-jf5q-85p7-vjm3

Cerebrate 1.12 does not properly consider organisation_id during creation of API keys.

MEDIUM 42

Cerebrate 1.12 does not properly consider organisation_id during creation of API keys.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00632 Published 2023-02-23 No fix listed

TI-2022-09013 CVE-2022-25321 · GHSA-48hf-57c2-8m4x