CVE-2026-36720

Vulnerability

A privilege escalation vulnerability exists in BookCars versions up to and including v8.3. The vulnerability resides in the /api/update-user endpoint, which allows authenticated users to modify their own user type without sufficient authorization checks. Specifically, the application accepts a type parameter directly from user input and applies it without validating the requesting user's privileges, potentially leading to privilege escalation [1].

Exploitation

An authenticated attacker with a standard user account can exploit this vulnerability. The attacker needs to send a crafted request to the /api/update-user endpoint, including their own user ID and a new type parameter set to 'admin'. The application will then update the user's role to administrator without verifying if the user making the request has the authority to perform such a change [1].

Impact

Successful exploitation allows an authenticated attacker to escalate their privileges from a regular user to an administrator. This grants them complete control over the application's access control system, potentially enabling them to perform any administrative action, modify other user accounts, or access sensitive data [1].

Mitigation

To mitigate this vulnerability, it is recommended to implement proper authorization checks on the /api/update-user endpoint to ensure that only administrators can modify user types. Additionally, consider removing the ability for users to update their own roles through this endpoint and enforce role-based access control (RBAC) for privileged operations. Logging all user type modification attempts is also advised for security auditing [1]. The fixed version and release date are not yet disclosed in the available references.