CVE-2026-116384
Received Received - Intake

Improper Authorization in Bdtask Garage 24 Garage Management Software

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulDB

Description
A weakness has been identified in Bdtask Garage 24 Garage Management Software 1.0. This vulnerability affects unknown code of the component Backend. Executing a manipulation can lead to improper authorization. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116384
EUVD
EUVD-2026-110024

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Bdtask Garage 24 Garage Management Software 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper authorization issue in Bdtask Garage 24 Garage Management Software 1.0. It allows an authenticated user to gain admin-level access by exploiting broken access control. The application fails to validate user roles server-side, treating any authenticated session as valid for admin endpoints. This enables unauthorized access to sensitive administrative modules.

Detection Guidance

I don't know

Check for unauthorized access to admin endpoints by monitoring server logs for requests to restricted routes. Inspect session cookies for tampering or missing role validation. Test if normal user sessions can access admin modules.

Impact Analysis

An attacker could exploit this to gain unauthorized admin access, allowing them to manipulate roles, manage customers, or alter ERP data. Since the exploit is publicly available, remote attacks are possible. The impact includes data breaches, unauthorized system changes, and potential disruption of operations.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires strict access controls and data protection, while HIPAA mandates secure handling of protected health information. Exploits like this may result in data breaches, triggering legal penalties and reputational damage.

Mitigation Strategies

Implement server-side role verification to validate user permissions before granting access to admin endpoints. Deploy centralized RBAC middleware to enforce proper authorization checks. Bind session cookies to role states to prevent privilege escalation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116384. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart