Threats tagged 'ghsa-pwxm-hjwv-54xf'

BookStack versions before 26.09.3 have a missing authorization vulnerability in the ImageController::checkImagePermission() function. This flaw allows authenticated non-admin users to bypass page-level content restrictions for images whose owning pages have been soft-deleted (moved to the recycle bin). The vulnerability arises because the permission check relies on Page::getPage(), which returns null for soft-deleted pages, causing the PageView check to be skipped silently. Attackers can enumerate image IDs to access metadata of restricted images. Additionally, users with image-update-all or image-delete-all privileges can manipulate images belonging to content they cannot view, causing persistent damage even after page restoration.