CVE-2026-129132

EUVD-2026-125547
MRBS before 1.13.0 contains an LDAP injection vulnerability in web/lib/MRBS/Auth/AuthLdap.php that interpolates unescaped login usernames into DN search and group-membership filters. Attackers with valid directory credentials outside the required group can submit crafted usernames that make the group filter always true, bypassing access restrictions.
LDAP Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.2 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/meeting-room-booking-system/mrbs-code/blob/299686ed64174a66448699f5ca0fb5e0e0ea9faa/web/lib/MRBS/Auth/AuthLdap.php#L749
https://github.com/meeting-room-booking-system/mrbs-code/commit/92f6f5610072ddb9e1b38074c410fc8be56947ed
https://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.13.0
https://github.com/meeting-room-booking-system/mrbs-code/security/advisories/GHSA-r543-f38c-cq6v
https://www.vulncheck.com/advisories/mrbs-before-1.13.0-ldap-injection-via-authldap-php-authentication-filter