Ramon de C Valle (rcvalle) reports:
There is a mass assignment vulnerability in the create method of the UsersController controller.
The create method in app/controllers/userscontroller.rb deletes the user-controlled user[admin] parameter from the params hash but saves it to a local variable and assigns it to the newly created user object bypassing the :attrprotected mechanism.
def create admin = params[:user].delete :admin @user = User.new(params[:user]){|u| u.admin = admin } if @user.save @user.roles << Role.findbyname("Anonymous") unless @user.roles.map(&:name).include? "Anonymous" processsuccess else processerror end end
Any non-admin user with permissions to create other (non-admin) users (i.e. with Manager role) can create arbitrary admin users by sending a specially-crafted POST request.
End of life: 8/9/2026, End of support: 8/9/2025, Latest version: 7.2.4
End of life: 8/9/2026, End of support: 8/9/2025, Latest version: 7.2.4
End of life: 11/7/2026, End of support: 5/7/2026, Latest version: 8.0.5.2
End of life: 11/7/2026, End of support: 5/7/2026, Latest version: 8.0.5.2
End of life: 10/10/2027, End of support: 10/10/2026, Latest version: 8.1.4.1