Executive brief
BookCars, a car rental management system, contains a security flaw that allows standard users to upgrade their own accounts to administrator status. By sending a specially crafted request to the user profile update service, an attacker can gain full control over the application. This could lead to unauthorized access to customer data, modification of rental records, and complete disruption of the service.
Technical details
A privilege escalation vulnerability exists in BookCars versions up to and including 8.3 due to insecure permission checks in the user update logic. The application exposes an endpoint at `/api/update-user` (handled by `userController.ts`) that accepts a `type` parameter from the request body without verifying if the requesting user has the authority to change their own role. An authenticated attacker can submit a POST request containing their user ID and a modified 'type' value (e.g., changing it to 'admin'). This allows a low-privileged user to bypass Role-Based Access Control (RBAC) and gain full administrative access to the backend.
Affected products
- BookCars BookCars <= v8.3
Timeline
- 2026-06-09: disclosed: Vulnerability details published on GitHub and NVD
- 2026-06-09: advisory