Executive brief
Cerebrate, an open-source orchestration tool, contains a security flaw where authenticated users can modify data belonging to other records. By manipulating the ID field in a web request, a user could update settings, roles, or user profiles they do not own. This could lead to unauthorized changes to system configurations or user accounts, potentially disrupting operations or escalating privileges.
Technical details
Cerebrate before version 1.37 is vulnerable to an Insecure Direct Object Reference (IDOR) / Authorization Bypass (CWE-639) due to permissive mass-assignment defaults. The application allowed the 'id' primary key field to be supplied through request input during CRUD edit operations and certain entity patching flows. An authenticated attacker can submit a crafted request containing the ID of a different record, causing the application to update that unrelated record instead of the one intended by the route parameter. Affected entities include User, Role, UserSetting, and LocalTool. The issue was resolved in version 1.37 by stripping the ID from request input after marshalling and globally marking the ID field as inaccessible in the base AppModel.
Affected products
- Cerebrate Project Cerebrate before 1.37
Timeline
- 2026-06-11: advisory: NVD publication date
- 2026-06-11: disclosed: Initial disclosure via CIRCL and GitHub commit