CVE-2026-67204

Name of the Vulnerable Software and Affected Versions BookStack versions prior to 26.05.4

Description Broken access control allows authenticated API users with image-update or image-delete permissions to manipulate avatars of other users. This occurs due to missing content-type restrictions in the Image Gallery API endpoints. An attacker can provide a user avatar's ID to the API controller, which bypasses the gallery and drawio restrictions typically enforced by the web controller. If the uploaded to field of the avatar matches a page ID that the attacker can access, the authorization check is bypassed, enabling the attacker to rename, replace, or delete the target avatar without needing user-management permissions.

Recommendations Update BookStack to version 26.05.4 or later.