CVE-2026-124026 | BDVDB-2026-401326 Detail
karlomikusbar-assistant
Description#
Bar Assistant 6.0.0-rc1 before 6.11.0 contains an incorrect authorization vulnerability in CocktailController::copy that allows registered users to bypass source cocktail membership checks. Attackers owning a bar can POST to /api/cocktails/{id}/copy with other bars' cocktail ids to copy private recipes and images into their own bar.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact none, availability impact none. Attack vector: network.
Weaknesses#
- CWE-863 Incorrect Authorization
References#
- https://github.com/karlomikus/bar-assistant/issues/641
- https://github.com/karlomikus/bar-assistant
- https://github.com/karlomikus/bar-assistant/commit/bb246d461faf8b50f7814e34b49eb6c3647d297f
- https://github.com/karlomikus/bar-assistant/releases/tag/v6.11.0
- https://github.com/karlomikus/bar-assistant/blob/v6.10.1/app/Http/Controllers/CocktailController.php#L535
- https://www.vulncheck.com/advisories/bar-assistant-6.0.0-rc1-before-6.11.0-incorrect-authorization-via-cocktail-copy
- https://hackmd.io/@hieund/cve-2026-124026-bar-assistant-cocktail-copy-cross-bar-idor
Exploit#
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.