{"id":"CVE-2026-129132","summary":"MRBS before 1.13.0 LDAP Injection via AuthLdap.php Authentication Filter","details":"MRBS before 1.13.0 contains an LDAP injection vulnerability in web/lib/MRBS/Auth/AuthLdap.php that interpolates unescaped login usernames into DN search and group-membership filters. Attackers with valid directory credentials outside the required group can submit crafted usernames that make the group filter always true, bypassing access restrictions.","aliases":["GHSA-r543-f38c-cq6v"],"modified":"2026-11-14T02:47:33.054128168Z","published":"2026-11-13T16:23:36.193Z","database_specific":{"cwe_ids":["CWE-90"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129132.json","unresolved_ranges":[{"extracted_events":[{"range":[{"fixed":"1.13.0"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"}]},{"extracted_events":[{"source":"DESCRIPTION","range":[{"fixed":"1.13.0"}]}]}],"cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129132.json"},{"type":"ARTICLE","url":"https://github.com/meeting-room-booking-system/mrbs-code/blob/299686ed64174a66448699f5ca0fb5e0e0ea9faa/web/lib/MRBS/Auth/AuthLdap.php#L749"},{"type":"FIX","url":"https://github.com/meeting-room-booking-system/mrbs-code/commit/92f6f5610072ddb9e1b38074c410fc8be56947ed"},{"type":"ADVISORY","url":"https://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.13.0"},{"type":"ADVISORY","url":"https://github.com/meeting-room-booking-system/mrbs-code/security/advisories/GHSA-r543-f38c-cq6v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129132"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/mrbs-before-1.13.0-ldap-injection-via-authldap-php-authentication-filter"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/meeting-room-booking-system/mrbs-code","events":[{"introduced":"0"},{"fixed":"92f6f5610072ddb9e1b38074c410fc8be56947ed"},{"fixed":"383c98214deed41ee05ce2cd3e7a57c3f72a0af0"}],"database_specific":{"extracted_events":[{"range":[{"fixed":"92f6f5610072ddb9e1b38074c410fc8be56947ed"}],"source":"REFERENCES_COMMIT"},{"original_tag":"v1.13.0","range":[{"fixed":"383c98214deed41ee05ce2cd3e7a57c3f72a0af0"}],"source":"REFERENCES_TAG"}]}}],"versions":["v1.12.3","v1.12.2","v1.11.6","v1.11.5","v1.11.2","v1.11.1","mrbs-1_11_0","mrbs-1_9_4","mrbs-1_9_3","mrbs-1_9_2","mrbs-1_9_1","mrbs-1_9_0","mrbs-1_8_0","mrbs-1_7_2","mrbs-1_7_1","mrbs-1_7_0","mrbs-1_6_0","mrbs-1_5_0","mrbs-1_4_11","mrbs-1_4_10","mrbs-1_4_9","mrbs-1_4_8","mrbs-1_4_7","mrbs-1_4_6","mrbs-1_4_5","mrbs-1_4_5rc2","mrbs-1_4_5rc1","mrbs-1_4_4_1","mrbs-1_4_4","mrbs-1_4_3","mrbs-1_4_2","mrbs-1_4_2rc1","mrbs-1_4_1","mrbs-1_4","mrbs-1_4beta2","mrbs-1_4beta1","mrbs-1_4_b1","mrbs-1_2_6_1","mrbs-1_2_6","mrbs-1_2_5","mrbs-1_2_4","mrbs-1_2_3","mrbs-1_2_2","mrbs-1_2_1","mrbs-1_2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-129132.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}]}