The vulnerability resides in the CocktailController::copy method, where an incorrect authorization check allows any authenticated user to copy cocktail data from another bar. This enables the attacker to obtain private recipes, associated images, and associated metadata that are not meant to be shared outside the original bar. Consequently, confidentiality of bar‑specific cocktails is compromised, and an attacker could use the copied recipes for competitive or malicious purposes.

The issue affects the bar‑assistant application developed by Karlomikus. All releases from 6.0.0‑rc1 up to, but not including, 6.11.0 are vulnerable. The affected component is the API endpoint /api/cocktails/{id}/copy in the CocktailController. Users who own a bar and are logged in can exploit the flaw.

The CVSS score of 5.3 indicates a medium severity vulnerability. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is a POST request to the copy endpoint supplied with the ID of a cocktail from another bar. Effective exploitation requires the attacker to be an authenticated registered user who owns a bar, which is a relatively low barrier for potential attackers within the community of bar‑assistant users.