PatchSiren cyber security CVE debrief

CVE-2026-53901 cerebrate CVE debrief

CVE-2026-53901 is a high-severity vulnerability in Cerebrate, a mass-assignment issue allowing attackers to create objects with chosen identifiers. The vulnerability exists in the generic CRUD add path of Cerebrate before version 1.37. The add() handler attempted to remove an attacker-supplied id from $params before normalizing the request through __massageInput(). However, the normalized $input could still contain an id field, allowing a user to supply an identifier that should have been server-controlled. Successful exploitation could allow creation of objects with attacker-chosen identifiers, potentially causing unauthorized data manipulation, object spoofing, inconsistent references, or disruption through identifier collisions.

Vendor: cerebrate
Product: Unknown
CVSS: HIGH 8.7
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-11
Original CVE updated: 2026-06-11
Advisory published: 2026-06-11
Advisory updated: 2026-06-11

Who should care

Users of Cerebrate before version 1.37 should apply the patch to prevent potential unauthorized data manipulation and object spoofing.

Technical summary

The vulnerability has a CVSS score of 8.7 and is classified as HIGH severity. It was fixed in v1.37 by removing id from the normalized input before entity patching.

Defensive priority

HIGH

Recommended defensive actions

Apply the patch by upgrading to Cerebrate version 1.37 or later.
Review and restrict permissions for affected endpoints to prevent unauthorized access.

Evidence notes

The CVE was published on 2026-06-11T09:16:25.763Z and modified on 2026-06-11T15:24:44.007Z. The vulnerability was fixed in v1.37.

Sources and references

Verified primary and authoritative sources

CVE-2026-53901 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-53901

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-53901 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-53901

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://github.com/cerebrate-project/cerebrate/commit/aff1ca707c8f926d00cda3deb39ff9bf59cdf18e

5a6e4751-2f3f-4070-9419-94fb35b644e8

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.