{"id":"CVE-2026-116384","kind":"vulnerability","aliases":["CVE-2026-116384"],"related":[],"title":"Bdtask Garage 24 Garage Management Software: backend flaw allows improper authorization remotely","description":"A weakness has been identified in Bdtask Garage 24 Garage Management Software 1.0. This vulnerability affects unknown code of the component Backend. Executing a manipulation can lead to improper authorization. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Bdtask Garage 24 Garage Management Software 1.0 has a weakness in its backend code that lets a remote user get around authorization checks. A public exploit exists, and the vendor did not respond to disclosure.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bdtask","garage-management","other","web-app"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-26T17:17:26+00:00","first_seen_at":"2026-10-26T17:31:22+00:00","triaged_at":"2026-10-26T17:33:15+00:00","updated_at":"2026-10-26T17:33:15+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-26T17:33:15Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"Bdtask Garage 24 Garage Management Software: backend flaw allows improper authorization remotely","impact":"medium","summary":"Bdtask Garage 24 Garage Management Software 1.0 has a weakness in its backend code that lets a remote user get around authorization checks. A public exploit exists, and the vendor did not respond to disclosure.","category":"other","nicknames":[],"who_cares":["garage-management","bdtask","web-app"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker bypasses authorization checks to reach restricted backend functions remotely","analyst_note":"Find the vendor advisory or an exploit write-up to identify affected endpoints and a fixed version; the NVD entry gives no fix.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running Bdtask Garage 24 Garage Management Software 1.0 with its backend exposed to the network are affected. The sources do not say which endpoints or configurations are involved, so unknown whether a particular setup can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000551,"input_tokens":3335,"output_tokens":435,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116384':15A,18A '-2026':14A,17A '1.0':33B,74C '24':3A,29B,70C 'affect':77C 'allow':9A 'app':26B 'around':47B 'attack':93C,112C 'author':11A,48B,91C 'avail':103C 'backend':7A,39B,83C 'bdtask':1A,19B,27B,68C 'check':49B 'code':40B,79C 'compon':82C 'contact':116C 'could':108C 'cve':13A,16A 'disclosur':61B,120C 'earli':117C 'execut':84C 'exist':53B 'exploit':52B,99C 'flaw':8A 'garag':2A,4A,21B,28B,30B,69C,71C 'garage-manag':20B 'get':46B 'identifi':66C 'improp':10A,90C 'launch':96C 'lead':88C 'let':42B 'made':102C 'manag':5A,22B,31B,72C 'manipul':86C 'public':51B,106C 'remot':12A,44B,97C 'respond':59B,124C 'softwar':6A,32B,73C 'unknown':78C 'use':110C 'user':45B 'vendor':56B,114C 'vulner':76C 'way':127C 'weak':36B,63C 'web':25B 'web-app':24B","nicknames":[],"mitigations":[],"who_affected":"Teams running Bdtask Garage 24 Garage Management Software 1.0 with its backend exposed to the network are affected. The sources do not say which endpoints or configurations are involved, so unknown whether a particular setup can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T17:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116384","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116384","severity":null,"published_at":"2026-10-26T17:17:26+00:00","modified_at":"2026-10-26T17:17:26+00:00","first_seen_at":"2026-10-26T17:31:22+00:00","fetched_at":"2026-10-26T17:31:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}