CVE-2026-124026 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
Bar Assistant versions from 6.0.0-rc1 before 6.11.0 let a registered user copy cocktails belonging to other bars through the copy endpoint, because the source cocktail's membership is not checked. An attacker who owns a bar can read another bar's private recipes and images and place them into their own bar.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any self-hosted Bar Assistant instance running a version from 6.0.0-rc1 up to but not including 6.11.0 where users can register accounts. Instances where only trusted administrators hold accounts face a much smaller risk. unknown whether the sources name a specific configuration that changes exposure.
Not affected if no-registered-users, version-6.11.0-or-later
Who cares bar-assistant, self-hosted
6.11.0.6.11.0 or later.Bar Assistant 6.0.0-rc1 before 6.11.0 contains an incorrect authorization vulnerability in CocktailController::copy that allows registered users to bypass source cocktail membership checks. Attackers owning a bar can POST to /api/cocktails/{id}/copy with other bars' cocktail ids to copy private recipes and images into their own bar.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.