EUVD-2026-110024
GHSA-rv22-rcgg-pg8h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
ExploitSend manipulated request to backend component
-
ExecutionBypass improper authorization check
-
ImpactAccess or alter unauthorized data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an existing low-privilege authenticated session on the Garage 24 Garage Management Software backend (CVSS PR:L), after which a manipulated request to the affected backend component bypasses an authorization check (CWE-285). The specific backend feature, endpoint, or configuration that triggers the flaw is not described in the available sources. Limiting factors: valid authentication is required (not exploitable by fully unauthenticated attackers), the impact is bounded (Low confidentiality, integrity, and availability only), and no scope change occurs (SC/SI/SA:N). No fixed version is provided in the evidence and the vendor did not respond to the disclosure, so no vendor-supplied remediation or mitigation is available at the time of analysis. |
| Impact | This is a low-priority issue despite being remotely reachable. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation, but PR:L means the attacker must already hold low-level authenticated access, and every impact metric is Low (VC:L/VI:L/VA:L), capping overall severity at 2.1. The vuln.today decision label is 'monitor,' consistent with that low score. There is no CISA KEV listing and no EPSS value in the input, so there is no signal of active or widespread exploitation. The exploit maturity is E:P (proof-of-concept), and the referenced PoC is a GitHub issue that is not verified as working exploit code, so this should not be treated as confirmed weaponized exploitation. In short, the signals are internally consistent and all point to a genuinely low real-world risk: an authenticated authorization flaw in a niche product, not a high-CVSS-but-overstated issue nor an urgent one. Note the only intelligence source is VulDB (single-sourced); no independent vendor advisory exists because the vendor did not respond. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege authenticated account on the Garage 24 backend sends a crafted request to a backend function that fails to properly check authorization, allowing access to data or actions beyond their permission level. A public PoC reference exists (a GitHub issue) but is not verified as working exploit code, so practical exploitation effort is unconfirmed. The specific trigger is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
Improper authorization in the backend component of Bdtask Garage 24 Garage Management Software 1.0 allows a remote user holding a low-privilege authenticated session to perform actions beyond their intended permissions, with limited confidentiality, integrity, and availability impact. The assessed vector requires valid authentication (PR:L) and shows no scope change, so the flaw is not reachable by fully unauthenticated attackers, and the specific backend feature or endpoint that triggers it is not described in the available sources. A public PoC reference exists but is not verified as working exploit code; the vendor did not respond to the disclosure, no fixed version is provided, and the current priority label is monitor, making this a low-priority issue despite being remotely reachable.
RemediationAI
No vendor-released patch has been identified at time of analysis: Bdtask was contacted about the disclosure and did not respond, and none of the listed references point to a fixed release, so any version of Garage 24 Garage Management Software 1.0 should be treated as unpatched. Because the defect is a missing authorization check in the backend rather than a network-reachable service flaw, the workable compensating controls are to restrict access to the backend/administrative interface to trusted networks or an authenticated reverse proxy so that only known operators can reach it (trade-off: remote staff lose direct access and must use VPN or a jump host), and to enforce strict separation of roles and least privilege across accounts, removing or demoting accounts that do not need backend access, which limits what a hijacked low-privilege session can reach but does not close the underlying bypass. Reviewing backend request logs for privileged operations issued by low-privilege sessions gives detection coverage where preventive controls cannot be applied. Until the vendor publishes a fixed version, monitoring the VulDB entry at https://vuldb.com/vuln/426353 is the available way to track updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-285 (Improper Authorization), meaning the backend component fails to verify that an authenticated user's role or privileges permit the requested operation before performing it. The affected product is identified by the CPE cpe:2.3:a:bdtask:garage_24_garage_management_software with a wildcard version field, so no specific release boundary is established in the available data and version 1.0 is the confirmed reference point. The assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) confirms remote reachability and a low-privilege authenticated prerequisite, while scope is unchanged and all impact dimensions are Low; VulDB's CVSS:4.0 record carries a base score of 2.1 with E:P. The underlying stack, the vulnerable function, and the request shape required to bypass the check are not described in the available sources, so the trigger cannot be reconstructed from this intelligence. The linked GitHub issue is a PoC reference only and has not been verified as working exploit code.
Know when Garage 24 Garage Management Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote and low-complexity but requires a low-privilege authenticated account (PR:L) for an improper-authorization flaw; impacts are limited to Low across C/I/A with no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in Bdtask Garage 24 Garage Management Software 1.0. This vulnerability affects unknown code of the component Backend. Executing a manipulation can lead to improper authorization. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB