CVE-2026-124026

Description

Bar Assistant 6.0.0-rc1 before 6.11.0 contains an incorrect authorization vulnerability in CocktailController::copy that allows registered users to bypass source cocktail membership checks. Attackers owning a bar can POST to /api/cocktails/{id}/copy with other bars' cocktail ids to copy private recipes and images into their own bar.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://github.com/karlomikus/bar-assistant/issues/641 ↗
• https://github.com/karlomikus/bar-assistant ↗
• https://github.com/karlomikus/bar-assistant/commit/bb246d461faf8b50f7814e34b49eb6c3647d297f ↗
• https://github.com/karlomikus/bar-assistant/releases/tag/v6.11.0 ↗
• https://github.com/karlomikus/bar-assistant/blob/v6.10.1/app/Http/Controllers/CocktailController.php#L535 ↗
• https://www.vulncheck.com/advisories/bar-assistant-6.0.0-rc1-before-6.11.0-incorrect-authorization-via-cocktail-copy ↗