{"id":"CVE-2026-67204","revision":"1ae252cd1f604f1b9bd4436a03bf6ba9","records":[{"revision":"1ae252cd1f604f1b9bd4436a03bf6ba9","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-67204","aliases":[],"title":"BookStack < 26.05.4 Broken Access Control via Image Gallery API","description":"BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a user avatar's ID to the API controller, which loads any image type without the web controller's gallery and drawio restrictions, and when the avatar's uploaded_to field matches a page ID accessible to the attacker, the authorization check passes allowing the attacker to rename, replace, or delete the target user's avatar without requiring user-management permission.","state":0,"publishedAt":"2026-08-24T15:33:13.649+00:00","modifiedAt":"2026-10-01T15:20:17.762+00:00","affected":[{"ecosystem":"Vendor product","name":"BookStack","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"affected\",\n                    \"vendor\": \"BookStackApp\",\n                    \"product\": \"BookStack\",\n                    \"packageURL\": \"pkg:github/BookStackApp/BookStack\",\n                    \"repo\": \"https://github.com/BookStackApp/BookStack\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"custom\",\n                            \"lessThan\": \"26.05.4\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","score":5.3,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","score":5.4,"severity":"MEDIUM"}],"references":["https://www.bookstackapp.com/blog/bookstack-release-v26-05-4/","https://codeberg.org/bookstack/bookstack/releases/tag/v26.05.4","https://github.com/BookStackApp/BookStack/releases/tag/v26.05.4","https://www.vulncheck.com/advisories/bookstack-broken-access-control-via-image-gallery-api"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-67204","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-67204","identifiers":["CVE-2026-67204"]},"retained":false,"historicalAffected":[]}],"coverage":[]}