CVE-2026-129132: MRBS before 1.13.0 LDAP Injection via AuthLdap.php Authentication Filter

Q: Who is realistically exposed to this issue?

MRBS deployments before 1.13.0 that use the vulnerable LDAP authentication path and enforce access through LDAP group-membership filters are exposed. An attacker must have valid directory credentials, but those credentials can belong to an account outside the required group.

Q: What does an attacker need to exploit it?

The attacker needs network access to the MRBS login interface, a valid directory account, and the ability to submit a crafted username during authentication. The crafted value is used unescaped in LDAP DN search and group-membership filters.

Q: Are default installations affected?

The available information identifies the affected component as LDAP authentication in AuthLdap.php and specifically describes bypassing required-group restrictions. It does not establish whether LDAP authentication or group-based restrictions are enabled by default.

Q: How can I determine whether my deployment is affected?

Check whether the MRBS version is earlier than 1.13.0 and whether it uses LDAP authentication with a required LDAP group for access control. Deployments not using this LDAP authentication and group-membership filtering scenario are not described as affected.

Published Nov 13, 2026

Updated

MRBS before 1.13.0 contains an LDAP injection vulnerability in web/lib/MRBS/Auth/AuthLdap.php that interpolates unescaped login usernames into DN search and group-membership filters. Attackers with valid directory credentials outside the required group can submit crafted usernames that make the group filter always true, bypassing access restrictions.

Affected Software

1 affected component

MRBS MRBS<1.13.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.13.0

Event History

Nov 13, 2026

CVE Published

via MITRE·04:23 PM

Data Sourced

via MITRE·04:23 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is realistically exposed to this issue?

MRBS deployments before 1.13.0 that use the vulnerable LDAP authentication path and enforce access through LDAP group-membership filters are exposed. An attacker must have valid directory credentials, but those credentials can belong to an account outside the required group.

What does an attacker need to exploit it?

The attacker needs network access to the MRBS login interface, a valid directory account, and the ability to submit a crafted username during authentication. The crafted value is used unescaped in LDAP DN search and group-membership filters.

Are default installations affected?

The available information identifies the affected component as LDAP authentication in AuthLdap.php and specifically describes bypassing required-group restrictions. It does not establish whether LDAP authentication or group-based restrictions are enabled by default.

How can I determine whether my deployment is affected?

Check whether the MRBS version is earlier than 1.13.0 and whether it uses LDAP authentication with a required LDAP group for access control. Deployments not using this LDAP authentication and group-membership filtering scenario are not described as affected.

CVE-2026-129132: MRBS before 1.13.0 LDAP Injection via AuthLdap.php Authentication Filter

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

Are default installations affected?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

Are default installations affected?

How can I determine whether my deployment is affected?