Cerebrate versions prior to 1.37 permitted an attacker to include a primary key id in a CRUD edit request, and if the target entity did not explicitly block write access to the id field, the save operation updated the record whose id matched the supplied value rather than the record identified by the route parameter. This mass‑assignment flaw (CWE‑639) allows a legitimate user to modify any writable fields of another record, potentially altering permissions, settings or other sensitive data and thereby compromising data integrity.

The flaw exists in the cerebrate:cerebrate application up to and including version 1.36. It affects several entity types inheriting permissive mass‑assignment defaults such as User, Role, UserSetting, LocalTool, PermissionLimitation and EnumerationCollection, all of which are accessible to authenticated users through edit or patch endpoints.

The CVSS score of 6.3 indicates moderate severity, while the EPSS score is not available, suggesting limited publicly observed exploitation. Cerebrate is not listed in CISA’s KEV catalog. The likely attack vector is an authenticated user who can reach the vulnerable endpoints; no elevated privileges are required. When a crafted edit payload containing another record’s id is submitted, the server updates that record, resulting in unauthorized data modification. Given the moderate score and lack of widespread attacks, the threat is considered moderate but not negligible.