CVE-2026-67204: Incorrect Authorization in BookStackApp BookStack
Description
BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a user avatar's ID to the API controller, which loads any image type without the web controller's gallery and drawio restrictions, and when the avatar's uploaded_to field matches a page ID accessible to the attacker, the authorization check passes allowing the attacker to rename, replace, or delete the target user's avatar without requiring user-management permission.
CVSS v4.0
Score 5.3medium
Affected software
BookStackApp
BookStack
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-67204 describes a broken access control vulnerability in BookStack prior to version 26.05.4. Authenticated API users who have image-update or image-delete permissions can exploit missing content-type restrictions in the Image Gallery API endpoints. By supplying a user avatar's ID to the API controller, which loads any image type without the usual gallery and drawio restrictions, attackers can bypass authorization checks when the avatar's uploaded_to field corresponds to a page ID accessible to them. This flaw enables attackers to rename, replace, or delete other users' avatars without needing user-management permissions.
Potential Impact
The vulnerability allows authenticated users with certain image permissions to manipulate other users' avatars, potentially impacting user identity representation within the application. It does not require elevated user-management permissions, lowering the bar for exploitation. The CVSS 4.0 score of 5.3 indicates a medium severity impact with network attack vector, low attack complexity, and no user interaction required.
Mitigation Recommendations
A fix is available in BookStack version 26.05.4. Users should upgrade to version 26.05.4 or later to remediate this vulnerability. No vendor advisory content was provided, so patch status is based on the affectedVersions field indicating the fix in 26.05.4.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-07-28T16:06:49.775Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a8c68d6acd9273b49c4d349
Added to database: 08/24/2026, 15:52:54 UTC
Last enriched: 10/02/2026, 15:51:07 UTC
Last updated: 10/08/2026, 06:48:19 UTC
Views: 75
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.