CVE-2026-67204 is an incorrect authorization vulnerability in BookStack before version 26.05.4. The flaw exists in the Image Gallery API endpoints where authenticated API users with image-update or image-delete permissions can supply a user avatar's ID to the API controller. The controller loads images without enforcing the web controller's gallery and drawio content-type restrictions. If the avatar's uploaded_to field matches a page ID accessible to the attacker, the authorization check incorrectly passes, allowing the attacker to rename, replace, or delete the target user's avatar without needing user-management permissions.

An attacker with authenticated API access and image-update or image-delete permissions can manipulate other users' avatars by renaming, replacing, or deleting them. This unauthorized modification does not require elevated user-management permissions, potentially impacting user identity representation within the application. There is no indication of remote code execution or data disclosure beyond avatar manipulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict API user permissions to trusted users only and monitor for suspicious avatar modifications. Avoid granting image-update or image-delete permissions broadly.