CVE-2026-67204— BookStack < 26.05.4 Broken Access Control via Image Gallery API
Quick assessment
Affected
BookStackApp BookStack
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 BookStack 26.05.4 版本之前，存在一个不安全的访问控制漏洞。该漏洞允许已认证的 API 用户（具备 image-update 或 image-delete 权限）通过利用 Image Gallery API 端点中缺失的内容类型限制，来操作其他用户的头像。 攻击者可以向 API 控制器提供一个用户头像的 ID，该控制器会加载任意类型的图像，且不施加 Web 控制器中画廊和 Draw.io 功能所设置的限制。当头像的 uploaded_to 字段匹配到攻击者可访问的页面 ID 时，授权检查即可通过
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-67204
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
BookStack < 26.05.4 Broken Access Control via Image Gallery API
Source: CVE Program / CVE List V5
Vulnerability Description
BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a user avatar's ID to the API controller, which loads any image type without the web controller's gallery and drawio restrictions, and when the avatar's uploaded_to field matches a page ID accessible to the attacker, the authorization check passes allowing the attacker to rename, replace, or delete the target user's avatar without requiring user-management permission.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| BookStackApp | BookStack | 0 ~ 26.05.4 | - |
|
II. Public POCs for CVE-2026-67204
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-67204
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-67204 (1)
Security Blog Posts for CVE-2026-67204 (1)
Vendor Pages for CVE-2026-67204 (2)
IV. Related Vulnerabilities
Same vendor: BookStackApp
-
CVE-2026-5484
BookStackApp BookStack Chapter Export ExportFormatter.php ch -
CVE-2023-4624
Server-Side Request Forgery (SSRF) in bookstackapp/bookstack -
CVE-2022-0877
Cross-site Scripting (XSS) - Stored in bookstackapp/bookstac -
CVE-2021-4194
Improper Access Control in bookstackapp/bookstack -
CVE-2021-4119
Improper Access Control in bookstackapp/bookstack
Same weakness: CWE-863
-
CVE-2026-78887
liketrek TREK Journey Photo Proxy validateShareTokenForAsset -
CVE-2026-79673
Ech0 before 4.4.3 Scope Bypass via profile:read Token -
CVE-2026-49050
Apache DolphinScheduler: General user can mint admin access -
CVE-2026-77134
Broken Access Control in extension "femanager" (femanager) -
CVE-2026-56710
Grav Login Plugin before 1.0.16 Privilege Escalation via Unl
V. Comments for CVE-2026-67204
No comments yet