CVE-2026-124026
4.3 MEDIUMpublic exploit availablePublished 2026-11-06 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Bar Assistant 6.0.0-rc1 before 6.11.0 contains an incorrect authorization vulnerability in CocktailController::copy that allows registered users to bypass source cocktail membership checks. Attackers owning a bar can POST to /api/cocktails/{id}/copy with other bars' cocktail ids to copy private recipes and images into their own bar.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-863
Public exploit & PoC references
- https://github.com/karlomikus/bar-assistant
- https://github.com/karlomikus/bar-assistant/blob/v6.10.1/app/Http/Controllers/CocktailController.php#L535
- https://github.com/karlomikus/bar-assistant/commit/bb246d461faf8b50f7814e34b49eb6c3647d297f
- https://github.com/karlomikus/bar-assistant/issues/641
- https://github.com/karlomikus/bar-assistant/releases/tag/v6.11.0
All references
- https://github.com/karlomikus/bar-assistant
- https://github.com/karlomikus/bar-assistant/blob/v6.10.1/app/Http/Controllers/CocktailController.php#L535
- https://github.com/karlomikus/bar-assistant/commit/bb246d461faf8b50f7814e34b49eb6c3647d297f
- https://github.com/karlomikus/bar-assistant/issues/641
- https://github.com/karlomikus/bar-assistant/releases/tag/v6.11.0
- https://www.vulncheck.com/advisories/bar-assistant-6.0.0-rc1-before-6.11.0-incorrect-authorization-via-cocktail-copy
- https://hackmd.io/@hieund/cve-2026-124026-bar-assistant-cocktail-copy-cross-bar-idor
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2024-22031PoC
- MEDIUMCVE-2025-13050PoC
- UNSCOREDCVE-2025-68392
- HIGHCVE-2026-100105
- MEDIUMCVE-2026-100145
- UNSCOREDCVE-2026-100252
- MEDIUMCVE-2026-100259
- HIGHCVE-2026-100262
Related by shared AI tags and CWE weakness class. Browse the full archive.