Threats tagged 'ghsa-4jvq-vx5m-qjj9'

frab versions through 0.9.1 have a privilege escalation vulnerability that allows authenticated crew users to escalate their privileges to orga roles by submitting unchecked nested conference_users_attributes. This flaw affects the UsersController#update and #create actions, which bypass filtering, enabling attackers to gain full management control over any conference, including events, schedules, reviewers, and crew.