BookStack EUVD-2026-64919

Exploitation requires three concurrent conditions: (1) the attacker must hold a valid BookStack API token with image-update or image-delete permission scope - these are non-default scopes that must be explicitly granted by an administrator; (2) the attacker must know or enumerate the numeric ID of the target user's avatar image; and (3) the target avatar's uploaded_to database field must reference a page ID that falls within the attacker's existing page-access permissions, which is the specific condition under which the broken authorization logic incorrectly approves the request. Instances where API access is restricted to administrators, or where image permissions are not delegated to non-admin tokens, are not exploitable. The impact is bounded to avatar integrity and availability - no path to data exfiltration, privilege escalation, or code execution exists through this vulnerability alone.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) places this as Medium (5.3), reflecting that exploitation requires an authenticated API token with specific image permissions - not unauthenticated remote access. Impact is confined to the integrity and availability of avatar images; no confidentiality breach or code execution is possible through this path alone. The vulnerability is absent from the CISA KEV catalog and no public POC has been surfaced, so there is no confirmed active exploitation signal. EPSS data was not provided and cannot be independently assessed from the available input. That said, the v26.05.4 release simultaneously patched a remote code execution vulnerability via ZIP import and multiple other issues, making the upgrade urgency significantly higher than this individual CVE's score implies - instances with untrusted users at edit-level access should treat the bundle as high priority. The realistic threat actor is an insider or a compromised API token, not an opportunistic external attacker.

An attacker with a BookStack API token bearing image-update permissions enumerates the numeric ID of a target user's avatar image - discoverable through the API or by observing profile image URLs. If that avatar record's uploaded_to field references a page the attacker can access (a plausible condition on shared instances with broad page visibility), they issue a standard API call to the Image Gallery endpoint to overwrite or delete the avatar, and the authorization check passes without any user-management privilege. No public exploit code is known, but the attack requires only documented API usage.