CVE-2026-116384 Details

A vulnerability has been identified in Bdtask Garage Management Software version 1.0, specifically within the Backend component. This weakness allows for improper authorization, enabling authenticated users to access restricted administrative endpoints and escalate privileges to admin level. The vulnerability arises because the application fails to enforce server-side authorization checks, treating all authenticated user sessions as valid for admin functions. As a result, users can manipulate their session cookies to gain unauthorized access to sensitive ERP data and administrative modules.

It is recommended to implement server-side role verification on all admin endpoints, establish centralized Role-Based Access Control (RBAC) middleware, and ensure that session cookies are tied to specific roles or permissions. Direct access to admin routes should be denied without proper authorization, and a comprehensive authorization audit should be conducted.