CVE-2026-67204

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-67204", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-07-28T16:06:49.775Z", "datePublished": "2026-08-24T15:33:13.649Z", "dateUpdated": "2026-10-01T15:20:17.762Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-01T15:20:17.762Z"}, "title": "BookStack < 26.05.4 Broken Access Control via Image Gallery API", "descriptions": [{"lang": "en", "value": "BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a user avatar's ID to the API controller, which loads any image type without the web controller's gallery and drawio restrictions, and when the avatar's uploaded_to field matches a page ID accessible to the attacker, the authorization check passes allowing the attacker to rename, replace, or delete the target user's avatar without requiring user-management permission."}], "tags": ["x_open-source"], "datePublic": "2026-08-24T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-863", "description": "Incorrect Authorization", "type": "CWE"}]}], "affected": [{"defaultStatus": "affected", "vendor": "BookStackApp", "product": "BookStack", "packageURL": "pkg:github/BookStackApp/BookStack", "repo": "https://github.com/BookStackApp/BookStack", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThan": "26.05.4"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:bookstackapp:bookstack:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.05.4"}]}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "LOW", "version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"}}], "references": [{"url": "https://www.bookstackapp.com/blog/bookstack-release-v26-05-4/", "name": "Maintainer Blog", "tags": ["vendor-advisory"]}, {"url": "https://codeberg.org/bookstack/bookstack/releases/tag/v26.05.4", "name": "Codeberg Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/BookStackApp/BookStack/releases/tag/v26.05.4", "name": "BookStack v26.05.4 Release Notes", "tags": ["release-notes"]}, {"url": "https://www.vulncheck.com/advisories/bookstack-broken-access-control-via-image-gallery-api", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "ByteMe.Red", "type": "finder"}, {"lang": "en", "value": "VulnCheck", "type": "coordinator"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-24T17:20:05.562340Z", "id": "CVE-2026-67204", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-24T17:20:18.693Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-67204", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T17:20:05.562340Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-24T17:20:12.218Z"}}], "cna": {"tags": ["x_open-source"], "title": "BookStack < 26.05.4 Broken Access Control via Image Gallery API", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "ByteMe.Red"}, {"lang": "en", "type": "coordinator", "value": "VulnCheck"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/BookStackApp/BookStack", "vendor": "BookStackApp", "product": "BookStack", "versions": [{"status": "affected", "version": "0", "lessThan": "26.05.4", "versionType": "custom"}], "packageURL": "pkg:github/BookStackApp/BookStack", "defaultStatus": "affected"}], "datePublic": "2026-08-24T00:00:00.000Z", "references": [{"url": "https://www.bookstackapp.com/blog/bookstack-release-v26-05-4/", "name": "Maintainer Blog", "tags": ["vendor-advisory"]}, {"url": "https://codeberg.org/bookstack/bookstack/releases/tag/v26.05.4", "name": "Codeberg Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/BookStackApp/BookStack/releases/tag/v26.05.4", "name": "BookStack v26.05.4 Release Notes", "tags": ["release-notes"]}, {"url": "https://www.vulncheck.com/advisories/bookstack-broken-access-control-via-image-gallery-api", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a user avatar's ID to the API controller, which loads any image type without the web controller's gallery and drawio restrictions, and when the avatar's uploaded_to field matches a page ID accessible to the attacker, the authorization check passes allowing the attacker to rename, replace, or delete the target user's avatar without requiring user-management permission."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "Incorrect Authorization"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bookstackapp:bookstack:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "26.05.4"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-01T15:20:17.762Z"}}}, "cveMetadata": {"cveId": "CVE-2026-67204", "state": "PUBLISHED", "dateUpdated": "2026-10-01T15:20:17.762Z", "dateReserved": "2026-07-28T16:06:49.775Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-24T15:33:13.649Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "packageURL": "pkg:github/BookStackApp/BookStack", "product": "BookStack", "repo": "https://github.com/BookStackApp/BookStack", "vendor": "BookStackApp", "versions": [{"lessThan": "26.05.4", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a user avatar's ID to the API controller, which loads any image type without the web controller's gallery and drawio restrictions, and when the avatar's uploaded_to field matches a page ID accessible to the attacker, the authorization check passes allowing the attacker to rename, replace, or delete the target user's avatar without requiring user-management permission."}, {"lang": "es", "value": "BookStack antes de 26.05.4 contiene una vulnerabilidad de control de acceso roto que permite a usuarios de API autenticados con permisos de actualizaci\u00f3n de imagen o eliminaci\u00f3n de imagen manipular los avatares de otros usuarios explotando restricciones de tipo de contenido faltantes en los puntos finales de la API de la Galer\u00eda de Im\u00e1genes. Los atacantes pueden suministrar el ID de un avatar de usuario al controlador de la API, el cual carga cualquier tipo de imagen sin las restricciones de galer\u00eda y drawio del controlador web, y cuando el campo uploaded_to del avatar coincide con un ID de p\u00e1gina accesible para el atacante, la verificaci\u00f3n de autorizaci\u00f3n pasa permitiendo al atacante renombrar, reemplazar o eliminar el avatar del usuario objetivo sin requerir permiso de gesti\u00f3n de usuarios."}], "id": "CVE-2026-67204", "lastModified": "2026-10-12T15:10:00.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67204", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-24T17:20:05.562340Z", "version": "2.0.3"}}]}, "published": "2026-08-24T16:17:17.790", "references": [{"source": "disclosure@vulncheck.com", "url": "https://codeberg.org/bookstack/bookstack/releases/tag/v26.05.4"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/BookStackApp/BookStack/releases/tag/v26.05.4"}, {"source": "disclosure@vulncheck.com", "url": "https://www.bookstackapp.com/blog/bookstack-release-v26-05-4/"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/bookstack-broken-access-control-via-image-gallery-api"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.05.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "BookStack", "source": "cna", "vendor": "BookStackApp"}, "product": "bookstack", "vendor": "bookstackapp"}], "created": "2026-08-24T17:45:03.720459+00:00", "updated": "2026-08-24T20:00:04.390584+00:00", "vendors": ["bookstackapp", "bookstackapp$PRODUCT$bookstack"]}