Skip to main content

BookStack CVE-2026-67204

| EUVDEUVD-2026-64919 MEDIUM
Incorrect Authorization (CWE-863)
2026-08-24 VulnCheck GHSA-v32j-vgqh-f22g
Authentication Bypass Bookstack
5.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.4 MEDIUM

Network vector with low-privilege API token required (PR:L); no confidentiality impact; integrity and availability limited to avatar images only; no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 24, 2026 - 16:25 vuln.today
Analysis Generated
Aug 24, 2026 - 16:25 vuln.today
Patch available
Aug 24, 2026 - 16:01 EUVD

DescriptionCVE.org

BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a user avatar's ID to the API controller, which loads any image type without the web controller's gallery and drawio restrictions, and when the avatar's uploaded_to field matches a page ID accessible to the attacker, the authorization check passes allowing the attacker to rename, replace, or delete the target user's avatar without requiring user-management permission.

AnalysisAI

Broken access control in BookStack's Image Gallery API before v26.05.4 allows authenticated API users holding image-update or image-delete permissions to manipulate any other user's profile avatar without requiring user-management privileges. The API controller accepts arbitrary image IDs and skips the content-type and gallery restrictions enforced by the web controller; when the target avatar's uploaded_to field references a page the attacker can already access, the authorization check incorrectly passes. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires three concurrent conditions: (1) the attacker must hold a valid BookStack API token with image-update or image-delete permission scope - these are non-default scopes that must be explicitly granted by an administrator; (2) the attacker must know or enumerate the numeric ID of the target user's avatar image; and (3) the target avatar's uploaded_to database field must reference a page ID that falls within the attacker's existing page-access permissions, which is the specific condition under which the broken authorization logic incorrectly approves the request. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) places this as Medium (5.3), reflecting that exploitation requires an authenticated API token with specific image permissions - not unauthenticated remote access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade BookStack to version 26.05.4 or later; this is the vendor-confirmed patched release per the advisory at https://www.bookstackapp.com/blog/bookstack-release-v26-05-4/, with update instructions at https://www.bookstackapp.com/docs/admin/updates. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Bookstack

View all
CVE-2021-4119 CRITICAL POC
9.8 Dec 15

bookstack is vulnerable to Improper Access Control. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
CVE-2020-26210 HIGH POC
8.7 Nov 03

In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execut
CVE-2021-3944 MEDIUM POC
6.8 Dec 02

bookstack is vulnerable to Cross-Site Request Forgery (CSRF). Rated medium severity (CVSS 6.8), this vulnerability is re
CVE-2023-6199 MEDIUM POC
6.5 Nov 20

Book Stack version 23.10.2 allows filtering local files on the server. Rated medium severity (CVSS 6.5), this vulnerabil
CVE-2021-3916 MEDIUM POC
6.5 Nov 05

bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Rated medium

CVE-2021-3906 MEDIUM POC
6.5 Oct 27

bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type. Rated medium severity (CVSS 6.5), this vulne
CVE-2021-3874 MEDIUM POC
6.5 Oct 15

bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Rated medium

CVE-2021-3758 MEDIUM POC
6.5 Sep 02

bookstack is vulnerable to Server-Side Request Forgery (SSRF). Rated medium severity (CVSS 6.5), this vulnerability is r
CVE-2021-3915 MEDIUM POC
5.7 Nov 13

bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type. Rated medium severity (CVSS 5.7), this vulne
CVE-2026-5484 MEDIUM POC
5.5 Apr 03

BookStack chapter export functionality allows unauthenticated remote attackers to bypass access controls via manipulatio
CVE-2022-0877 MEDIUM POC
5.4 Mar 08

Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3. Rated medium severity
CVE-2021-3768 MEDIUM POC
5.4 Sep 06

bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated m

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-67204 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy