CVE-2026-36720: Insecure permissions in bookcars v8

Synopsis

An insecure permissions vulnerability in bookcars v8.3 allows an authenticated attacker to escalate their own privileges from a regular user account to administrator level by modifying the user type field directly. The vulnerability is reachable over the network and requires only a low-privilege account, with no victim interaction needed. Successful exploitation gives the attacker full administrative access, enabling read and modification of data across the application. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker must be able to reach the bookcars service via standard network connectivity.

• AuthenticationRequired

  A valid low-privilege user account is required, but no elevated or administrative credentials are needed to attempt the privilege escalation.

• Victim interactionNot required

  No user interaction or social engineering is involved; the attacker acts entirely on their own without needing any target user to take an action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is straightforward, repeatable, and does not depend on race conditions or specific environmental configuration.

Blast Radius

• An attacker gains administrator-level access to the bookcars application, unlocking all administrative functions and data.
• With elevated privileges, the attacker reads sensitive application data including user records, booking histories, and any stored credentials or tokens.
• The attacker can modify application data, including user accounts, bookings, pricing, and system configuration, with no logging or approval barrier once privilege escalation is complete.