GHSA-4rpj-w8fh-483qMediumCVSS 4.3
Bar Assistant 6.0.0-rc1 before 6.11.0 contains an incorrect authorization vulnerability in...
🔗 CVE IDs covered (1)
📋 Description
Bar Assistant 6.0.0-rc1 before 6.11.0 contains an incorrect authorization vulnerability in CocktailController::copy that allows registered users to bypass source cocktail membership checks. Attackers owning a bar can POST to /api/cocktails/{id}/copy with other bars' cocktail ids to copy private recipes and images into their own bar.
🔗 References (8)
- https://nvd.nist.gov/vuln/detail/CVE-2026-124026
- https://github.com/karlomikus/bar-assistant/issues/641
- https://github.com/karlomikus/bar-assistant/commit/bb246d461faf8b50f7814e34b49eb6c3647d297f
- https://github.com/karlomikus/bar-assistant
- https://github.com/karlomikus/bar-assistant/blob/v6.10.1/app/Http/Controllers/CocktailController.php#L535
- https://github.com/karlomikus/bar-assistant/releases/tag/v6.11.0
- https://www.vulncheck.com/advisories/bar-assistant-6.0.0-rc1-before-6.11.0-incorrect-authorization-via-cocktail-copy
- https://github.com/advisories/GHSA-4rpj-w8fh-483q