CVE-2026-67204
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Broken access control vulnerability in BookStack before 26.05.4 allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints.
Risk Assessment
An attacker could alter or delete other users' avatars, potentially leading to data integrity and trust issues.
Recommendation
Update BookStack to version 26.05.4 or later and restrict API permissions to the minimum necessary.
Other vulnerabilities in BookStack
See all- CVE-2026-82450High
BookStack before version 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests.
- CVE-2026-5484Medium
A weakness has been identified in BookStackApp BookStack up to version 26.03 in the chapterToMarkdown function of app/Exports/ExportFormatter.php (Chapter Export Handler). Manipulating the pages argument can lead to improper access controls. The attack can be launched remotely and the exploit is publicly available.
Original NVD description (English source)
BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a user avatar's ID to the API controller, which loads any image type without the web controller's gallery and drawio restrictions, and when the avatar's uploaded_to field matches a page ID accessible to the attacker, the authorization check passes allowing the attacker to rename, replace, or delete the target user's avatar without requiring user-management permission.