CVE-2026-36720 describes an access control vulnerability in bookcars v8.3 where authenticated attackers can escalate privileges by altering their user type to gain administrative rights. The vulnerability arises from insecure permissions that do not properly restrict modification of user roles. The CVSS vector indicates the attack can be performed remotely over the network with low attack complexity and no user interaction, affecting confidentiality and integrity but not availability. There is no vendor advisory or patch information available at this time.

Successful exploitation allows an authenticated user to escalate privileges to an administrator level, potentially leading to unauthorized access to administrative functions and sensitive data modification. The impact affects confidentiality and integrity but does not affect system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user permissions and monitor for unauthorized privilege changes where possible. Avoid granting unnecessary privileges to users and consider additional access controls to limit modification of user roles.