CVE-2026-36721 Details

An authorization bypass vulnerability has been identified in BookCars versions through 8.3. The issue arises in the validateAccessToken function, where the authentication middleware improperly relies on the Origin header to assess user roles for endpoint access. This flaw enables authenticated attackers to bypass authentication by spoofing the Origin header to align with user frontend host values, tricking the server into applying regular user permissions to admin-only endpoints. Consequently, attackers can gain unauthorized access to sensitive administrative functions.

Implement proper role-based access control (RBAC) by explicitly defining required roles at the endpoint level, rather than inferring them from client-controlled headers. Additionally, validate the authenticated user's actual role from the database against the endpoint's required permissions.