Cerebrate before version 1.37 contains a mass‑assignment flaw in the generic CRUD add handler. The code removes an attacker‑supplied id from the request parameters, then normalizes the input; however, the normalized input can still contain an id field. This allows a user who can reach the vulnerable add endpoint to create new objects with identifiers of their choosing. Successful exploitation can lead to unauthorized object creation, data manipulation, spoofing of existing records, and possible disruption caused by identifier collisions.

Cerebrate, all releases earlier than 1.37. No version numbers are provided beyond this upper bound; users should verify they are running a version 1.37 or higher to avoid the issue.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, suggesting that while the probability of exploitation is unknown, the potential impact is significant. The likely attack vector is an HTTP request to a publicly or otherwise exposed CRUD add endpoint; the attacker needs permission to reach that endpoint but does not require elevated privileges to cause the problem.