Improper input validation in Cerebrate
CVE-2026-53901
Cerebrate before version 1.37 contains a mass-assignment vulnerability in the generic CRUD add path. The add() handler attempted to remove an attacker-supplied id from $params before normalizing the request through __massageInput(). Becaus…
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.003 (23.5th percentile) — read the EPSS interpretation.
Affected products
- Cerebrate — versions 0