Medium severity4.3NVD Advisory· Published Nov 6, 2026
CVE-2026-124026
CVE-2026-124026
Description
Bar Assistant 6.0.0-rc1 before 6.11.0 contains an incorrect authorization vulnerability in CocktailController::copy that allows registered users to bypass source cocktail membership checks. Attackers owning a bar can POST to /api/cocktails/{id}/copy with other bars' cocktail ids to copy private recipes and images into their own bar.
Affected products
2- Range: <6.11.0
- Range: <6.11.0
Patches
Vulnerability mechanics
References
5- github.com/karlomikus/bar-assistant/blob/v6.10.1/app/Http/Controllers/CocktailController.phpnvd
- github.com/karlomikus/bar-assistant/commit/bb246d461faf8b50f7814e34b49eb6c3647d297fnvd
- github.com/karlomikus/bar-assistant/issues/641nvd
- github.com/karlomikus/bar-assistant/releases/tag/v6.11.0nvd
- www.vulncheck.com/advisories/bar-assistant-6.0.0-rc1-before-6.11.0-incorrect-authorization-via-cocktail-copynvd
News mentions
0No linked articles in our index yet.