PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-53901 cerebrate CVE debrief

CVE-2026-53901 is a high-severity vulnerability in Cerebrate, a mass-assignment issue allowing attackers to create objects with chosen identifiers. The vulnerability exists in the generic CRUD add path of Cerebrate before version 1.37. The add() handler attempted to remove an attacker-supplied id from $params before normalizing the request through __massageInput(). However, the normalized $input could still contain an id field, allowing a user to supply an identifier that should have been server-controlled. Successful exploitation could allow creation of objects with attacker-chosen identifiers, potentially causing unauthorized data manipulation, object spoofing, inconsistent references, or disruption through identifier collisions.

Vendor
cerebrate
Product
Unknown
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-11
Original CVE updated
2026-06-11
Advisory published
2026-06-11
Advisory updated
2026-06-11

Who should care

Users of Cerebrate before version 1.37 should apply the patch to prevent potential unauthorized data manipulation and object spoofing.

Technical summary

The vulnerability has a CVSS score of 8.7 and is classified as HIGH severity. It was fixed in v1.37 by removing id from the normalized input before entity patching.

Defensive priority

HIGH

Recommended defensive actions

  • Apply the patch by upgrading to Cerebrate version 1.37 or later.
  • Review and restrict permissions for affected endpoints to prevent unauthorized access.

Evidence notes

The CVE was published on 2026-06-11T09:16:25.763Z and modified on 2026-06-11T15:24:44.007Z. The vulnerability was fixed in v1.37.

Official resources

CVE-2026-53901 was published on 2026-06-11T09:16:25.763Z.