Auth bypass in Cerebrate

CVE-2026-53911

Cerebrate before version 1.37 allowed the id primary key field to be supplied through request input during CRUD edit operations and certain custom entity patching flows. In affected entities that did not explicitly mark id as inaccessible…

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.002 (10.9th percentile) — read the EPSS interpretation.