CVE-2025-66385 Privilege escalation in Cerebrate
Authenticated non-privileged users can escalate privileges to admin by modifying role or organization fields in the user edit endpoint.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-66385?
CVE-2025-66385 is a critical vulnerability in cerebrate-project Cerebrate, published on 28 Nov 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a higher role such as admin) via the user-edit endpoint by supplying or modifying role_id or organisation_id fields in the edit request.
Weakness: CWE-472
Which versions are affected by CVE-2025-66385?
How do I fix CVE-2025-66385?
No fix has been published for CVE-2025-66385 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-66385 being exploited?
There is no known exploitation of CVE-2025-66385 in the wild and no public exploit code.
Sources
Also known as GHSA-xh4p-6jqr-58x9.