CVE-2026-36720 Overview
CVE-2026-36720 is a privilege escalation vulnerability in bookcars version 8.3, an open-source car rental application. The flaw stems from insecure permissions that allow authenticated users to modify their own userType attribute. By altering this field, a low-privileged user can elevate their account to administrator. The weakness is classified under [CWE-284] Improper Access Control.
Critical Impact
Any authenticated bookcars user can promote themselves to administrator, gaining full control over the application, its data, and connected resources.
Affected Products
- bookcars v8.3
Discovery Timeline
- 2026-06-09 - CVE-2026-36720 published to NVD
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-36720
Vulnerability Analysis
The bookcars application maintains a userType attribute on each user account that determines role-based access. The backend fails to enforce server-side authorization when this attribute is modified through user profile update endpoints. Authenticated attackers can submit a request that changes their own userType value from user to admin. Once the account is updated, the attacker receives administrative privileges on subsequent authenticated requests.
Exploitation requires only a valid, low-privileged account on the target instance. No user interaction, social engineering, or additional authentication is needed. The attack is conducted entirely over the network through the application's standard API.
The EPSS score for this issue is 0.023% as of 2026-06-11, reflecting limited observed exploitation activity. However, the trivial exploitation path and complete loss of confidentiality and integrity make remediation a priority for any production deployment.
Root Cause
The application trusts client-supplied input for a security-critical field. The user update handler accepts and persists the userType value from the request body without verifying whether the requester is permitted to alter that attribute. Role assignment should be restricted to administrative endpoints with strict authorization checks.
Attack Vector
An authenticated attacker sends a profile update request to the bookcars API that includes a modified userType field set to an administrative role. The server stores the change and grants admin-level access on subsequent requests. Refer to the GitHub Vulnerability Repository for proof-of-concept details.
Detection Methods for CVE-2026-36720
Indicators of Compromise
- User accounts whose userType value changed from user to admin without an administrator-initiated action.
- Profile update API requests containing a userType field in the request body.
- Unexpected admin logins from accounts that were previously standard users.
Detection Strategies
- Audit the user database for accounts elevated to admin since deployment and reconcile changes against legitimate administrative actions.
- Inspect application logs for PUT or PATCH requests to user profile endpoints that include role-related fields.
- Correlate role changes with the source IP and session of the request to identify self-elevation events.
Monitoring Recommendations
- Enable verbose audit logging on all account modification endpoints and forward logs to a centralized analytics platform.
- Alert on any change to the userType attribute, regardless of source.
- Monitor administrative action volume for unusual spikes following user registration events.
How to Mitigate CVE-2026-36720
Immediate Actions Required
- Upgrade bookcars to a patched release that enforces server-side authorization on user role changes.
- Review all existing accounts and demote any unauthorized administrators.
- Rotate API tokens and session secrets to invalidate any sessions tied to compromised accounts.
Patch Information
No official vendor patch URL is listed in the NVD record at this time. Track the GitHub Vulnerability Repository and the upstream bookcars project for fixed releases beyond version 8.3.
Workarounds
- Apply a server-side allowlist that strips the userType field from profile update requests before they reach the database layer.
- Restrict role assignment to a dedicated admin-only endpoint protected by middleware that validates the caller's role.
- Place the bookcars application behind a web application firewall rule that blocks request bodies containing userType on non-administrative routes.
# Example WAF rule pattern (ModSecurity)
SecRule REQUEST_URI "@beginsWith /api/user" \
"chain,deny,status:403,id:1026036720,\
msg:'Block userType modification on user endpoint'"
SecRule REQUEST_BODY "@rx \"userType\"\\s*:" "t:none"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
