CVE-2026-125364: frab through 0.9.1 Privilege Escalation via conference_users_attributes in UsersController
frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant themselves orga roles by submitting unchecked nested conferenceusersattributes. Attackers can abuse UsersController#update or #create, which skip filterconferenceusers, to gain orga on any conference and fully manage its events, schedule, reviewers and crew.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who already has a crew account can exploit it. The issue enables that user to assign themselves an orga role for any conference.
What access does an attacker gain after exploitation?
The attacker gains orga privileges on the targeted conference. This permits full management of that conference's events, schedule, reviewers, and crew.
Which application paths are involved?
The affected paths are UsersController#update and UsersController#create. These paths skip filter_conference_users when processing nested conference_users_attributes.
Are installations using frab 0.9.1 affected?
Yes. The affected range is frab through version 0.9.1, so version 0.9.1 is included.