CVE-2026-67204 in BookStack
Summary
by MITRE • 08/24/2026
BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a user avatar's ID to the API controller, which loads any image type without the web controller's gallery and drawio restrictions, and when the avatar's uploaded_to field matches a page ID accessible to the attacker, the authorization check passes allowing the attacker to rename, replace, or delete the target user's avatar without requiring user-management permission.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/24/2026
The vulnerability identified in BookStack versions prior to 26.05.4 represents a critical broken access control flaw within the application’s Image Gallery API endpoints. This issue stems from an insufficient separation of concerns between the web-based interface and the programmatic API layer, specifically regarding how image uploads are processed and validated. In standard operations, users interact with avatars through the web controller which enforces strict content-type restrictions and gallery-specific logic to ensure that only permitted file types are uploaded and displayed correctly within the application's visual context. However, the underlying API endpoints responsible for handling these images lack equivalent validation mechanisms. This architectural inconsistency creates a pathway where authenticated users can bypass intended security controls by directly invoking API methods rather than using the web interface.
The core technical flaw lies in the absence of content-type restrictions and gallery-specific filtering within the Image Gallery API controller. When an attacker interacts with this endpoint, they are able to supply arbitrary image identifiers associated with other users' avatars. Because the API does not enforce the same rigorous checks as the web frontend, it accepts any valid image type without verifying if the operation aligns with standard user expectations or security policies. This lack of validation allows for a form of unauthorized object reference manipulation where the attacker can target specific avatar IDs belonging to other users in the system. The vulnerability is particularly insidious because it does not require high-level administrative privileges, relying instead on lower-privileged permissions that are commonly granted to regular contributors within collaborative environments.
The operational impact of this vulnerability allows authenticated API users who possess image-update or image-delete permissions to perform unauthorized actions against other users' avatars. Specifically, an attacker can rename, replace, or completely delete the avatar images associated with target user accounts. This capability is significant because it disrupts the integrity and availability of user identity representations within the platform. Furthermore, the authorization check passes based on a specific condition: when the uploaded_to field of the image matches a page ID that is accessible to the attacker. This means that if an attacker has read access to any page in BookStack, they can potentially leverage this vulnerability against avatars linked to those pages or other entities within their scope of visibility. The ability to delete or replace these images effectively denies service to the affected users and can be used for social engineering attacks by altering visual identities associated with specific accounts.
From a classification perspective, this vulnerability aligns closely with CWE-284 Improper Access Control, as it involves an actor bypassing intended restrictions on access to resources. It also relates to CWE-915 Improvement of Incorrectly Controlled API Endpoint using Exploitable Client-Side Mechanisms, although in this case the exploitation is server-side via direct API calls rather than client-side manipulation. In terms of the MITRE ATT&CK framework, this behavior corresponds to T1078 Valid Accounts and potentially T1496 Host-Based Proxy or Resource Hijacking if used for broader system compromise, though primarily it falls under privilege escalation through improper access control mechanisms. The attack vector is classified as Network-based with an Authentication requirement, indicating that while the attacker must be authenticated, they do not need to hold high-level administrative roles such as user-management permissions to execute the exploit.
Mitigation strategies should focus on enforcing consistent security controls across both web and API interfaces. Developers must ensure that content-type validation and gallery-specific restrictions are applied uniformly regardless of whether an image upload is initiated via a browser or through direct API calls. Implementing strict input validation at the API layer to verify that the requesting user has explicit permission to modify the specific resource being targeted, rather than relying solely on broader page access rights, is essential. Additionally, applying role-based access control (RBAC) principles more granularly can prevent users with image-edit permissions from affecting resources outside their designated scope. For organizations currently running vulnerable versions of BookStack, immediate upgrading to version 26.05.4 or later is the primary remediation step. Until an upgrade is feasible, restricting API access to trusted internal networks and monitoring for unusual patterns in avatar modification requests can help mitigate the risk of exploitation by malicious insiders or compromised accounts with limited privileges.