BookStack EUVD-2026-78821

Exploitation requires the BookStack instance to have at least two social login providers enabled that share the same driver_id namespace, because the flaw is that SocialAuthService::handleLoginCallback retrieves linked-account records by driver_id while ignoring the driver column. The attacker must be able to authenticate at one enabled provider using a user ID that matches (collides with) the driver_id of a victim account linked under a different provider. Limiting factors: instances with only a single social provider, or with password-only/LDAP authentication and no overlapping driver_id values, are not exploitable; the required namespace collision and control of a matching provider account is what drives the AC:H rating. No end-user victim interaction is required (UI:N) and no prior authentication to BookStack is needed (PR:N).

This is a genuine authentication-bypass (CWE-290) enabling full account takeover, and the signals are mostly consistent. The vendor CVSS 4.0 vector (AV:N/AC:H/PR:N/UI:N/VC:H/VI:H/VA:N, 9.1) is well-calibrated: network-reachable and unauthenticated (PR:N), but AC:H correctly reflects that exploitation is not turnkey - it requires the instance to have at least two social login providers enabled sharing the same driver_id namespace, and the attacker must be able to authenticate at one provider with a user ID that collides with a victim's account linked under a different provider. SSVC reinforces a moderate priority: Exploitation:none (no observed activity), Automatable:no (setup-dependent, not spray-and-pray), Technical Impact:total (successful bypass yields the victim's full account, potentially admin). No EPSS score was provided, there is no CISA KEV listing, and no public exploit code is referenced - so this is a patch-promptly issue for exposed BookStack instances using social login, not an emergency mass-exploitation event. The 9.1 headline overstates real-world ease of exploitation somewhat because of the multi-provider/namespace-collision precondition; on a CVSS 3.1 basis this maps closer to ~7.1 (High). No key signals directly conflict, but note EPSS is absent from the input so probabilistic exploitation likelihood cannot be quantified.

A BookStack instance has two or more social login providers enabled (e.g. Google plus GitHub) whose driver_id values are looked up without distinguishing the provider. An unauthenticated attacker registers/controls an account at one enabled provider whose user ID matches the driver_id of a victim's account linked under a different provider, completes that provider's OAuth flow, and BookStack's SocialAuthService::handleLoginCallback matches the record ignoring the driver column - logging the attacker in as the victim (including a potential administrator). No public exploit code is referenced at time of analysis.