frab vulnerabilities

Products

• frab 1

Latest frab CVEs

Newest publication first

1. CVE-2026-125364 frab through 0.9.1 Privilege Escalation via conference_users_attributes in UsersController

   Published 2026-11-09

   High·CVSS 8.6 EPSS 0.30%

   frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant themselves orga roles by submitting unchecked nested conference_users_attributes. Attackers can abuse UsersController#update or #create, which skip filter_conference_use...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.