{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "cerebrate",
          "vendor": "cerebrate",
          "versions": [
            {
              "lessThan": "1.31",
              "status": "affected"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Andras Iklody"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A mass assignment vulnerability exists in the \u003ccode\u003eAlignment\u003c/code\u003e entity of Cerebrate prior to the fixed version, where insufficient access control on entity fields allowed attackers to set protected attributes. Due to the absence of a restrictive \u003ccode\u003e$_accessible\u003c/code\u003e configuration, attackers could manipulate sensitive fields such as \u003ccode\u003eid\u003c/code\u003e and \u003ccode\u003ecreated\u003c/code\u003e during entity creation or update operations, potentially leading to data integrity issues and unauthorized record manipulation."
            }
          ],
          "value": "A mass assignment vulnerability exists in the Alignment entity of Cerebrate prior to the fixed version, where insufficient access control on entity fields allowed attackers to set protected attributes. Due to the absence of a restrictive $_accessible configuration, attackers could manipulate sensitive fields such as id and created during entity creation or update operations, potentially leading to data integrity issues and unauthorized record manipulation."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/cerebrate-project/cerebrate/commit/02a8d13b63a8b09454289a392891edf3da2adc97"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper Access Control in Cerebrate Alignment Model Allows Mass Assignment of Sensitive Fields",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "datePublished": "2026-01-13T15:31:00.000Z",
    "dateUpdated": "2026-01-13T15:38:02.888546Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "gcve-1-2026-0005",
    "vulnerabilitylookup_history": [
      [
        "alexandre.dulaunoy@circl.lu",
        "2026-01-13T15:31:55.283404Z"
      ],
      [
        "alexandre.dulaunoy@circl.lu",
        "2026-01-13T15:38:02.888546Z"
      ]
    ]
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}