CVE-2026-36720 Details

A privilege escalation vulnerability exists in BookCars versions through 8.3. It allows authenticated users to change their user type to admin by modifying the 'type' parameter via the '/api/update-user' endpoint. The issue arises from inadequate authorization checks, enabling users to elevate their privileges and gain unauthorized access to administrative functions.

Implement proper authorization checks to ensure that only administrators can modify user roles. Remove the capability for users to update their own roles through the self-service update endpoint. Apply role-based access control (RBAC) to restrict privileged operations and log all user role modification attempts for security auditing.