Ramon de C Valle (rcvalle) reports:

There is a mass assignment vulnerability in the create method of the
UsersController controller.

The create method in app/controllers/users_controller.rb deletes the 
user-controlled user[admin] parameter from the params hash but saves it to a 
local variable and assigns it to the newly created user object bypassing the 
:attr_protected mechanism.

  def create
    admin = params[:user].delete :admin
    @user = User.new(params[:user]){|u| u.admin = admin }
    if @user.save
      @user.roles << Role.find_by_name("Anonymous") unless @user.roles.map(&:name).include? "Anonymous"
      process_success
    else
      process_error
    end
  end

Any non-admin user with permissions to create other (non-admin) users
(i.e. with Manager role) can create arbitrary admin users by sending a
specially-crafted POST request.