Incorrect Authorization Vulnerability in Bar Assistant Product by Karlomikus

CVE-2026-124026

What is CVE-2026-124026?

The Bar Assistant product version 6.0.0-rc1 and earlier has an incorrect authorization vulnerability in the CocktailController::copy function. This flaw allows registered users to bypass membership checks for cocktails. An attacker running a bar could exploit this flaw by sending a POST request to the /api/cocktails/{id}/copy endpoint with the IDs of cocktails from other bars, thereby gaining unauthorized access to private recipes and associated images. This vulnerability poses a risk to the confidentiality of proprietary cocktail information across different establishments.

References