Is CVE-2026-53911 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53911 being exploited in the wild.

How severe is CVE-2026-53911?

Informational severity, with a CVSS score of 6.3, published 11 June 2026.

Which products and versions are affected?

Cerebrate Project Cerebrate before 1.37.

Is there a fix for CVE-2026-53911?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-53911 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-53911?

Check whether you run Cerebrate Project Cerebrate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53911: Cerebrate authorization bypass via ID mass-assignment in CRUD edit

CVE-2026-53911 · Severity: info · CVSS 6.3 · Published 2026-06-11

Cerebrate, an open-source orchestration tool, contains a security flaw where authenticated users can modify data belonging to other records. By manipulating the ID field in a web request, a user could update settings, roles, or user profiles they do not own. This could lead to unauthorized changes to system configurations or user accounts, potentially disrupting operations or escalating privileges.

Technologies: Cerebrate Project Cerebrate. Vendors: Cerebrate Project.

Quick answers

Is CVE-2026-53911 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53911 being exploited in the wild.
How severe is CVE-2026-53911?: Informational severity, with a CVSS score of 6.3, published 11 June 2026.
Which products and versions are affected?: Cerebrate Project Cerebrate before 1.37.
Is there a fix for CVE-2026-53911?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-53911 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-53911?: Check whether you run Cerebrate Project Cerebrate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Cerebrate before version 1.37 is vulnerable to an Insecure Direct Object Reference (IDOR) / Authorization Bypass (CWE-639) due to permissive mass-assignment defaults. The application allowed the 'id' primary key field to be supplied through request input during CRUD edit operations and certain entity patching flows. An authenticated attacker can submit a crafted request containing the ID of a different record, causing the application to update that unrelated record instead of the one intended by the route parameter. Affected entities include User, Role, UserSetting, and LocalTool. The issue was resolved in version 1.37 by stripping the ID from request input after marshalling and globally marking the ID field as inaccessible in the base AppModel.

Affected products

Cerebrate Project Cerebrate before 1.37

Timeline

2026-06-11: advisory: NVD publication date
2026-06-11: disclosed: Initial disclosure via CIRCL and GitHub commit

References

https://github.com/cerebrate-project/cerebrate/commit/b3c8f951b0634f05691339512ef06cc261afecaf

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.