CVE-2026-67204
Received Received - Intake

Broken Access Control in BookStack Avatar Handling

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulnCheck

Description
BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a user avatar's ID to the API controller, which loads any image type without the web controller's gallery and drawio restrictions, and when the avatar's uploaded_to field matches a page ID accessible to the attacker, the authorization check passes allowing the attacker to rename, replace, or delete the target user's avatar without requiring user-management permission.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-67204
EUVD
EUVD-2026-64919

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bookstack bookstack to 26.05.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

BookStack before version 26.05.4 has a broken access control flaw in its Image Gallery API. Authenticated users with image-update or image-delete permissions can manipulate other users' avatars by exploiting missing content-type restrictions. Attackers supply a target user's avatar ID to the API, which bypasses normal image restrictions. If the avatar's uploaded_to field matches a page the attacker can access, they can rename, replace, or delete the avatar without needing user-management permissions.

Detection Guidance

Check for unexpected non-image files in BookStack's image upload folders. Use commands like 'find /path/to/uploads -type f ! -name "*.[iI][mM][gG]"' to list non-image files. Review API logs for unauthorized avatar modifications or image manipulation attempts.

Impact Analysis

This vulnerability allows attackers to alter other users' profile avatars, potentially leading to misrepresentation or social engineering attacks. It could be used to impersonate users, spread misleading information, or disrupt user trust within the BookStack instance. The impact is limited to authenticated users with specific permissions but could affect all users if exploited.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to user avatars, which may contain personal or sensitive data. Unauthorized manipulation of avatars could lead to data breaches or unauthorized exposure of personal information, violating privacy requirements under these regulations.

Mitigation Strategies

Update BookStack to version 26.05.4 or later immediately. Verify all image upload folders contain only valid image files. Restrict API permissions for image-update and image-delete actions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67204. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart