Read the docs
TI-2026-86086 Aliases CVE-2026-124026GHSA-4rpj-w8fh-483q

Incorrect authorization in Bar Assistant lets users copy private recipes

Priority LOW 24CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Bar Assistant from 6.0.0-rc1 before 6.11.0 contains an incorrect authorization flaw in CocktailController::copy. The copy operation skips the membership check on the source cocktail. A registered user who owns a bar can copy other bars' private cocktail recipes and images into their own bar by POSTing other bars' cocktail ids to /api/cocktails/{id}/copy.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Bar Assistant 6.0.0-rc1 before 6.11.0 contains an incorrect authorization vulnerability in CocktailController::copy that allows registered users to bypass source cocktail membership checks. Attackers owning a bar can POST to /api/cocktails/{id}/copy with other bars' cocktail ids to copy private recipes and images into their own bar.

Why it matters now

EPSS 0.00298 22nd percentileScored 2026-11-07
Fix Fixed bar-assistant (karlomikus): 6.11.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
karlomikusbar-assistant6.0.0-rc1 to before 6.11.06.11.0Patch availableCNA
  • bar-assistant Vendorkarlomikus Affected 6.0.0-rc1 to before 6.11.0 Fixed in 6.11.0 Patch available CNA

Remediation

Upgrade karlomikus bar-assistant to version 6.11.0, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA bar-assistant (karlomikus) Fixed in 6.11.0

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-124026
  2. 2026-11-06 Alias added: GHSA-4rpj-w8fh-483q

References

Patch 1

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences