CVE-2026-67204: BookStack < 26.05.4 Broken Access Control via Image Gallery API
BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a user avatar's ID to the API controller, which loads any image type without the web controller's gallery and drawio restrictions, and when the avatar's uploadedto field matches a page ID accessible to the attacker, the authorization check passes allowing the attacker to rename, replace, or delete the target user's avatar without requiring user-management permission.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BookStackto a version that resolves this vulnerability.Fixed in 26.05.4 - Compensating control
Because the issue affects BookStack before 26.05.4, restrict access to the Image Gallery API endpoints so only appropriately authorized users (with only their own allowed image-update/image-delete permissions) can call the avatar manipulation functions.
Event History
Frequently Asked Questions
Which accounts are realistically able to exploit this issue?
Authenticated API users that have image-update or image-delete permission can exploit it. They do not need user-management permission.
What additional condition is needed to target another user's avatar?
The attacker must supply the avatar's image ID, and the avatar's uploaded_to field must match a page ID the attacker can access. Under those conditions, the authorization check passes.
Are installations running version 26.05.4 affected?
The issue is described as affecting BookStack versions before 26.05.4. Version 26.05.4 is identified as the release boundary in the available information.
What actions can an attacker perform against a targeted avatar?
An attacker can rename, replace, or delete the avatar through the Image Gallery API endpoints.