{"id":"CVE-2026-124026","kind":"vulnerability","aliases":["CVE-2026-124026"],"related":[],"title":"Bar Assistant: registered users can copy other bars' private cocktail recipes","description":"Bar Assistant 6.0.0-rc1 before 6.11.0 contains an incorrect authorization vulnerability in CocktailController::copy that allows registered users to bypass source cocktail membership checks. Attackers owning a bar can POST to /api/cocktails/{id}/copy with other bars' cocktail ids to copy private recipes and images into their own bar.","summary":"Bar Assistant versions from 6.0.0-rc1 before 6.11.0 let a registered user copy cocktails belonging to other bars through the copy endpoint, because the source cocktail's membership is not checked. An attacker who owns a bar can read another bar's private recipes and images and place them into their own bar.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","bar-assistant","self-hosted"],"not_affected_if":["no-registered-users","version-6.11.0-or-later"],"how_to_check":"- Check the installed Bar Assistant version and confirm whether it is below `6.11.0`.\n- Look at the application's version string or release tag in the deployment.","fix":"- Bar Assistant: upgrade to `6.11.0` or later.","status":"open","published_at":"2026-11-06T20:17:20+00:00","first_seen_at":"2026-11-06T20:43:59+00:00","triaged_at":"2026-11-06T20:44:21+00:00","updated_at":"2026-11-06T20:44:21+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-06T20:44:21Z","model":"claude-haiku-5-5","output":{"fix":"- Bar Assistant: upgrade to `6.11.0` or later.","reach":"network","title":"Bar Assistant: registered users can copy other bars' private cocktail recipes","impact":"low","summary":"Bar Assistant versions from 6.0.0-rc1 before 6.11.0 let a registered user copy cocktails belonging to other bars through the copy endpoint, because the source cocktail's membership is not checked. An attacker who owns a bar can read another bar's private recipes and images and place them into their own bar.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["bar-assistant","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Registered users copy other bars' private recipes and images","analyst_note":"","how_to_check":"- Check the installed Bar Assistant version and confirm whether it is below `6.11.0`.\n- Look at the application's version string or release tag in the deployment.","plain_action":"","needs_analyst":false,"not_affected_if":["version-6.11.0-or-later","no-registered-users"],"who_is_affected":"Any self-hosted Bar Assistant instance running a version from 6.0.0-rc1 up to but not including 6.11.0 where users can register accounts. Instances where only trusted administrators hold accounts face a much smaller risk. unknown whether the sources name a specific configuration that changes exposure.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000697,"input_tokens":4310,"output_tokens":533,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124026':14A,17A '-2026':13A,16A '/api/cocktails':111C '/copy':113C '6.0.0':31B,82C '6.11.0':34B,85C 'ai':19B 'ai-tool':18B 'allow':95C 'anoth':66B 'assist':2A,23B,28B,81C 'attack':59B,104C 'author':89C 'bar':1A,8A,22B,27B,44B,63B,67B,79B,80C,107C,116C,128C 'bar-assist':21B 'belong':41B 'bypass':99C 'check':57B,103C 'cocktail':10A,40B,52B,101C,117C 'cocktailcontrol':92C 'contain':86C 'copi':6A,39B,47B,93C,120C 'cve':12A,15A 'endpoint':48B 'host':26B 'id':112C,118C 'imag':72B,124C 'incorrect':88C 'let':35B 'membership':54B,102C 'own':61B,105C 'place':74B 'post':109C 'privat':9A,69B,121C 'rc1':32B,83C 'read':65B 'recip':11A,70B,122C 'regist':3A,37B,96C 'self':25B 'self-host':24B 'sourc':51B,100C 'tool':20B 'user':4A,38B,97C 'version':29B 'vulner':90C","nicknames":[],"mitigations":[],"who_affected":"Any self-hosted Bar Assistant instance running a version from 6.0.0-rc1 up to but not including 6.11.0 where users can register accounts. Instances where only trusted administrators hold accounts face a much smaller risk. unknown whether the sources name a specific configuration that changes exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","barassistant","medium","selfhosted"],"campaign_type":null,"search_a":"'-124026':14A,17A '-2026':13A,16A 'assist':2A 'bar':1A,8A 'cocktail':10A 'copi':6A 'cve':12A,15A 'privat':9A 'recip':11A 'regist':3A 'user':4A","search_b":"'6.0.0':31B '6.11.0':34B 'ai':19B 'ai-tool':18B 'anoth':66B 'assist':23B,28B 'attack':59B 'bar':22B,27B,44B,63B,67B,79B 'bar-assist':21B 'belong':41B 'check':57B 'cocktail':40B,52B 'copi':39B,47B 'endpoint':48B 'host':26B 'imag':72B 'let':35B 'membership':54B 'own':61B 'place':74B 'privat':69B 'rc1':32B 'read':65B 'recip':70B 'regist':37B 'self':25B 'self-host':24B 'sourc':51B 'tool':20B 'user':38B 'version':29B","search_c":"'/api/cocktails':111C '/copy':113C '6.0.0':82C '6.11.0':85C 'allow':95C 'assist':81C 'attack':104C 'author':89C 'bar':80C,107C,116C,128C 'bypass':99C 'check':103C 'cocktail':101C,117C 'cocktailcontrol':92C 'contain':86C 'copi':93C,120C 'id':112C,118C 'imag':124C 'incorrect':88C 'membership':102C 'own':105C 'post':109C 'privat':121C 'rc1':83C 'recip':122C 'regist':96C 'sourc':100C 'user':97C 'vulner':90C","first_public_at":"2026-11-06T20:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124026","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124026","severity":null,"published_at":"2026-11-06T20:17:20+00:00","modified_at":"2026-11-06T20:17:20+00:00","first_seen_at":"2026-11-06T20:43:59+00:00","fetched_at":"2026-11-06T20:43:59+00:00","note":null}],"documents":[{"id":89771,"url":"https://github.com/karlomikus/bar-assistant/commit/bb246d461faf8b50f7814e34b49eb6c3647d297f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89772,"url":"https://github.com/karlomikus/bar-assistant/releases/tag/v6.11.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":89773,"url":"https://www.vulncheck.com/advisories/bar-assistant-6.0.0-rc1-before-6.11.0-incorrect-authorization-via-cocktail-copy","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}