CVE-2026-53901

Cerebrate before version 1.37 contains a mass-assignment vulnerability in the generic CRUD add path. The add() handler attempted to remove an attacker-supplied id from $params before normalizing the request through __massageInput(). Because the normalized $input could still contain an id field, a user able to reach an affected add endpoint could supply an identifier that should have been server-controlled. Successful exploitation could allow creation of objects with attacker-chosen identifiers, potentially causing unauthorized data manipulation, object spoofing, inconsistent references, or disruption through identifier collisions, depending on the affected model and endpoint permissions. The issue was fixed in v1.37 by removing id from the normalized input before entity patching.

• CWE-20

• https://github.com/cerebrate-project/cerebrate/commit/aff1ca707c8f926d00cda3deb39ff9bf59cdf18e

Published

Jun 11, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53875picklescan before 1.0.3 contains a scanning bypass vulnerabi…7.1
• CVE-2026-53876RadiX AX6600 WiFi 6 Tri-Band Gaming Router contains an OS co…8.6
• CVE-2026-53877An issue was discovered in Django 6.0 before 6.0.7 and 5.2 b…6.3
• CVE-2026-53878An issue was discovered in Django 6.0 before 6.0.7 and 5.2 b…6.1
• CVE-2026-53899Firefox for iOS used partial domain matching when attaching …6.5
• CVE-2026-53900Firefox for iOS preserved cookies set on the initial PDF req…4.3
• CVE-2026-53902MCO does not properly enforce authorization checks in the /c…6.5
• CVE-2026-53903MCO is vulnerable to an Insecure Direct Object Reference (ID…8.1
• CVE-2026-53904MCO is vulnerable to Account Denial of Service due to improp…7.1
• CVE-2026-53905MCO does not properly enforce authorization checks in the /c…7.1
• CVE-2026-53906MCO is vulnerable to Path Disclosure and Path Traversal in f…8.2
• CVE-2026-53907MCO is vulnerable to Stored Cross‑Site Scripting (XSS) via t…5.4