{"schema_version":"2","view":"grouped","data":[{"id":56300,"cve_ids":["CVE-2026-116020"],"payload":{"kind":"advisory","title":"BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages","summary":"BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or replace files on another user's unpublished draft pages.","evidence":"cve:CVE-2026-116020","products":[{"name":{"value":"BookStack","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-116020","aliases":["CVE-2026-116020"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"repo":"https://codeberg.org/bookstack/bookstack","vendor":"BookStackApp","product":"BookStack","versions":[{"status":"affected","version":"0","lessThan":"26.09.2","versionType":"custom"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T11:40:36.328Z","provider":"cve","references":["https://codeberg.org/bookstack/bookstack/commit/fcadecccda706b4ecaf9ac3f8e27defe0ebe78ae","https://www.bookstackapp.com/blog/bookstack-release-v26-09-2/","https://codeberg.org/bookstack/bookstack/releases/tag/v26.09.2","https://codeberg.org/bookstack/bookstack/src/tag/v26.09.1/app/Uploads/Controllers/AttachmentController.php","https://www.vulncheck.com/advisories/bookstack-before-26.09.2-incorrect-authorization-via-attachmentcontroller-on-draft-pages"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-24T11:40:36.328Z"}}},"related_cves":[{"value":"CVE-2026-116020","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:283d2e34-427d-4368-b29f-c828db3a2683","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116020","advisory_id":"283d2e34-427d-4368-b29f-c828db3a2683","event_types":["advisory"],"published_at":"2026-10-25T16:12:33.598196+00:00","technologies":["bookstack","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T11:40:36.328+00:00","detail_url":"/advisories/advisory%3A283d2e34-427d-4368-b29f-c828db3a2683","group":{"id":"advisory:283d2e34-427d-4368-b29f-c828db3a2683","revision":1,"primary_event_id":55823,"change":"published","superseded_by":[],"changed":{"id":55823,"cve_ids":["CVE-2026-116020"],"payload":{"kind":"advisory","title":"BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages","summary":"BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or replace files on another user's unpublished draft pages.","evidence":"cve:CVE-2026-116020","products":[{"name":{"value":"BookStack","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-116020","aliases":["CVE-2026-116020"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"repo":"https://codeberg.org/bookstack/bookstack","vendor":"BookStackApp","product":"BookStack","versions":[{"status":"affected","version":"0","lessThan":"26.09.2","versionType":"custom"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T11:40:36.328Z","provider":"cve","references":["https://codeberg.org/bookstack/bookstack/commit/fcadecccda706b4ecaf9ac3f8e27defe0ebe78ae","https://www.bookstackapp.com/blog/bookstack-release-v26-09-2/","https://codeberg.org/bookstack/bookstack/releases/tag/v26.09.2","https://codeberg.org/bookstack/bookstack/src/tag/v26.09.1/app/Uploads/Controllers/AttachmentController.php","https://www.vulncheck.com/advisories/bookstack-before-26.09.2-incorrect-authorization-via-attachmentcontroller-on-draft-pages"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-24T11:40:36.328Z"}}},"related_cves":[{"value":"CVE-2026-116020","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:283d2e34-427d-4368-b29f-c828db3a2683","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116020","advisory_id":"283d2e34-427d-4368-b29f-c828db3a2683","event_types":["advisory"],"published_at":"2026-10-25T16:12:33.598196+00:00","technologies":["bookstack","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T11:40:36.328+00:00","detail_url":"/events/55823"},"members":[{"id":55823,"cve_ids":["CVE-2026-116020"],"payload":{"kind":"advisory","title":"BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages","summary":"BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or replace files on another user's unpublished draft pages.","evidence":"cve:CVE-2026-116020","products":[{"name":{"value":"BookStack","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-116020","aliases":["CVE-2026-116020"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"repo":"https://codeberg.org/bookstack/bookstack","vendor":"BookStackApp","product":"BookStack","versions":[{"status":"affected","version":"0","lessThan":"26.09.2","versionType":"custom"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T11:40:36.328Z","provider":"cve","references":["https://codeberg.org/bookstack/bookstack/commit/fcadecccda706b4ecaf9ac3f8e27defe0ebe78ae","https://www.bookstackapp.com/blog/bookstack-release-v26-09-2/","https://codeberg.org/bookstack/bookstack/releases/tag/v26.09.2","https://codeberg.org/bookstack/bookstack/src/tag/v26.09.1/app/Uploads/Controllers/AttachmentController.php","https://www.vulncheck.com/advisories/bookstack-before-26.09.2-incorrect-authorization-via-attachmentcontroller-on-draft-pages"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-24T11:40:36.328Z"}}},"related_cves":[{"value":"CVE-2026-116020","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:283d2e34-427d-4368-b29f-c828db3a2683","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116020","advisory_id":"283d2e34-427d-4368-b29f-c828db3a2683","event_types":["advisory"],"published_at":"2026-10-25T16:12:33.598196+00:00","technologies":["bookstack","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T11:40:36.328+00:00","detail_url":"/events/55823"}]}},{"id":13071,"cve_ids":["CVE-2026-82450"],"payload":{"kind":"advisory","title":"BookStack before 26.05.4 Remote Code Execution via Book Cover","summary":"BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests.","evidence":"cve:CVE-2026-82450","products":[{"name":{"value":"bookstack","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-82450","aliases":["CVE-2026-82450"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"bookstackapp","product":"bookstack","versions":[{"status":"affected","version":"0","lessThan":"26.05.4","versionType":"custom"}],"packageURL":"pkg:composer/ssddanbrown/bookstack","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:51:45.531Z","provider":"cve","references":["https://github.com/BookStackApp/BookStack/commit/e210cc32e4cbb1efeae5c5c9d0fef8e3c6a752e6","https://github.com/BookStackApp/BookStack","https://www.vulncheck.com/advisories/bookstack-before-26.05.4-remote-code-execution-via-book-cover"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-82450","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-31T18:21:11.099545Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-31T18:21:21.212Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:51:45.531Z"}}},"related_cves":[{"value":"CVE-2026-82450","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:896b2f5c-c85e-46c7-868e-63af162270aa","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82450","advisory_id":"896b2f5c-c85e-46c7-868e-63af162270aa","event_types":["advisory"],"published_at":"2026-10-25T00:17:25.351937+00:00","technologies":["bookstack","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-29T13:47:53.312+00:00","detail_url":"/advisories/advisory%3A896b2f5c-c85e-46c7-868e-63af162270aa","group":{"id":"advisory:896b2f5c-c85e-46c7-868e-63af162270aa","revision":1,"primary_event_id":13003,"change":"published","superseded_by":[],"changed":{"id":13003,"cve_ids":["CVE-2026-82450"],"payload":{"kind":"advisory","title":"BookStack before 26.05.4 Remote Code Execution via Book Cover","summary":"BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests.","evidence":"cve:CVE-2026-82450","products":[{"name":{"value":"bookstack","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-82450","aliases":["CVE-2026-82450"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"bookstackapp","product":"bookstack","versions":[{"status":"affected","version":"0","lessThan":"26.05.4","versionType":"custom"}],"packageURL":"pkg:composer/ssddanbrown/bookstack","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:51:45.531Z","provider":"cve","references":["https://github.com/BookStackApp/BookStack/commit/e210cc32e4cbb1efeae5c5c9d0fef8e3c6a752e6","https://github.com/BookStackApp/BookStack","https://www.vulncheck.com/advisories/bookstack-before-26.05.4-remote-code-execution-via-book-cover"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-82450","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-31T18:21:11.099545Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-31T18:21:21.212Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:51:45.531Z"}}},"related_cves":[{"value":"CVE-2026-82450","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:896b2f5c-c85e-46c7-868e-63af162270aa","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82450","advisory_id":"896b2f5c-c85e-46c7-868e-63af162270aa","event_types":["advisory"],"published_at":"2026-10-25T00:17:25.351937+00:00","technologies":["bookstack","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-29T13:47:53.312+00:00","detail_url":"/events/13003"},"members":[{"id":13003,"cve_ids":["CVE-2026-82450"],"payload":{"kind":"advisory","title":"BookStack before 26.05.4 Remote Code Execution via Book Cover","summary":"BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests.","evidence":"cve:CVE-2026-82450","products":[{"name":{"value":"bookstack","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-82450","aliases":["CVE-2026-82450"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"bookstackapp","product":"bookstack","versions":[{"status":"affected","version":"0","lessThan":"26.05.4","versionType":"custom"}],"packageURL":"pkg:composer/ssddanbrown/bookstack","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:51:45.531Z","provider":"cve","references":["https://github.com/BookStackApp/BookStack/commit/e210cc32e4cbb1efeae5c5c9d0fef8e3c6a752e6","https://github.com/BookStackApp/BookStack","https://www.vulncheck.com/advisories/bookstack-before-26.05.4-remote-code-execution-via-book-cover"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-82450","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-31T18:21:11.099545Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-31T18:21:21.212Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:51:45.531Z"}}},"related_cves":[{"value":"CVE-2026-82450","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:896b2f5c-c85e-46c7-868e-63af162270aa","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82450","advisory_id":"896b2f5c-c85e-46c7-868e-63af162270aa","event_types":["advisory"],"published_at":"2026-10-25T00:17:25.351937+00:00","technologies":["bookstack","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-29T13:47:53.312+00:00","detail_url":"/events/13003"}]}},{"id":5561,"cve_ids":["CVE-2026-89022"],"payload":{"kind":"advisory","title":"BookStack < 26.05.5 Authentication Bypass via Social Login Provider Confusion","summary":"BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows unauthenticated attackers to sign in as arbitrary users by authenticating through a different social provider sharing the same driver_id namespace. Attackers can authenticate at one enabled social provider using a user ID that matches an account linked to a different social provider, bypassing credential verification entirely because the SocialAuthService::handleLoginCallback query ignores the driver column when retrieving linked account records.","evidence":"cve:CVE-2026-89022","products":[{"name":{"value":"bookstack","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-89022","aliases":["CVE-2026-89022"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":9.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"CRITICAL","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/bookstackapp/bookstack","vendor":"bookstackapp","product":"bookstack","versions":[{"status":"affected","version":"0","lessThan":"26.05.5","versionType":"custom"}],"packageURL":"pkg:github/bookstackapp/bookstack","defaultStatus":"unaffected"}],"modified":"2026-10-01T15:21:50.290Z","provider":"cve","references":["https://www.bookstackapp.com/blog/bookstack-release-v26-05-5/","https://www.vulncheck.com/advisories/bookstack-authentication-bypass-via-social-login-provider-confusion"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-89022","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-15T19:04:04.179125Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-15T19:04:50.041Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-01T15:21:50.290Z"}}},"related_cves":[{"value":"CVE-2026-89022","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a6dde215-6541-4642-bf6b-09ac622e5159","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-89022","advisory_id":"a6dde215-6541-4642-bf6b-09ac622e5159","event_types":["advisory"],"published_at":"2026-10-24T22:10:42.07337+00:00","technologies":["bookstack","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-15T16:11:56.151+00:00","detail_url":"/advisories/advisory%3Aa6dde215-6541-4642-bf6b-09ac622e5159","group":{"id":"advisory:a6dde215-6541-4642-bf6b-09ac622e5159","revision":1,"primary_event_id":5583,"change":"published","superseded_by":[],"changed":{"id":5583,"cve_ids":["CVE-2026-89022"],"payload":{"kind":"advisory","title":"BookStack < 26.05.5 Authentication Bypass via Social Login Provider Confusion","summary":"BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows unauthenticated attackers to sign in as arbitrary users by authenticating through a different social provider sharing the same driver_id namespace. Attackers can authenticate at one enabled social provider using a user ID that matches an account linked to a different social provider, bypassing credential verification entirely because the SocialAuthService::handleLoginCallback query ignores the driver column when retrieving linked account records.","evidence":"cve:CVE-2026-89022","products":[{"name":{"value":"bookstack","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-89022","aliases":["CVE-2026-89022"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":9.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"CRITICAL","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/bookstackapp/bookstack","vendor":"bookstackapp","product":"bookstack","versions":[{"status":"affected","version":"0","lessThan":"26.05.5","versionType":"custom"}],"packageURL":"pkg:github/bookstackapp/bookstack","defaultStatus":"unaffected"}],"modified":"2026-10-01T15:21:50.290Z","provider":"cve","references":["https://www.bookstackapp.com/blog/bookstack-release-v26-05-5/","https://www.vulncheck.com/advisories/bookstack-authentication-bypass-via-social-login-provider-confusion"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-89022","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-15T19:04:04.179125Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-15T19:04:50.041Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-01T15:21:50.290Z"}}},"related_cves":[{"value":"CVE-2026-89022","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a6dde215-6541-4642-bf6b-09ac622e5159","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-89022","advisory_id":"a6dde215-6541-4642-bf6b-09ac622e5159","event_types":["advisory"],"published_at":"2026-10-24T22:10:42.07337+00:00","technologies":["bookstack","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-15T16:11:56.151+00:00","detail_url":"/events/5583"},"members":[{"id":5583,"cve_ids":["CVE-2026-89022"],"payload":{"kind":"advisory","title":"BookStack < 26.05.5 Authentication Bypass via Social Login Provider Confusion","summary":"BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows unauthenticated attackers to sign in as arbitrary users by authenticating through a different social provider sharing the same driver_id namespace. Attackers can authenticate at one enabled social provider using a user ID that matches an account linked to a different social provider, bypassing credential verification entirely because the SocialAuthService::handleLoginCallback query ignores the driver column when retrieving linked account records.","evidence":"cve:CVE-2026-89022","products":[{"name":{"value":"bookstack","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-89022","aliases":["CVE-2026-89022"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":9.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"CRITICAL","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/bookstackapp/bookstack","vendor":"bookstackapp","product":"bookstack","versions":[{"status":"affected","version":"0","lessThan":"26.05.5","versionType":"custom"}],"packageURL":"pkg:github/bookstackapp/bookstack","defaultStatus":"unaffected"}],"modified":"2026-10-01T15:21:50.290Z","provider":"cve","references":["https://www.bookstackapp.com/blog/bookstack-release-v26-05-5/","https://www.vulncheck.com/advisories/bookstack-authentication-bypass-via-social-login-provider-confusion"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-89022","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-15T19:04:04.179125Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-15T19:04:50.041Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-01T15:21:50.290Z"}}},"related_cves":[{"value":"CVE-2026-89022","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a6dde215-6541-4642-bf6b-09ac622e5159","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-89022","advisory_id":"a6dde215-6541-4642-bf6b-09ac622e5159","event_types":["advisory"],"published_at":"2026-10-24T22:10:42.07337+00:00","technologies":["bookstack","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-15T16:11:56.151+00:00","detail_url":"/events/5583"}]}},{"id":5429,"cve_ids":["CVE-2026-67204"],"payload":{"kind":"advisory","title":"BookStack < 26.05.4 Broken Access Control via Image Gallery API","summary":"BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a user avatar's ID to the API controller, which loads any image type without the web controller's gallery and drawio restrictions, and when the avatar's uploaded_to field matches a page ID accessible to the attacker, the authorization check passes allowing the attacker to rename, replace, or delete the target user's avatar without requiring user-management permission.","evidence":"cve:CVE-2026-67204","products":[{"name":{"value":"BookStack","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-67204","aliases":["CVE-2026-67204"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/BookStackApp/BookStack","vendor":"BookStackApp","product":"BookStack","versions":[{"status":"affected","version":"0","lessThan":"26.05.4","versionType":"custom"}],"packageURL":"pkg:github/BookStackApp/BookStack","defaultStatus":"affected"}],"modified":"2026-10-01T15:20:17.762Z","provider":"cve","references":["https://www.bookstackapp.com/blog/bookstack-release-v26-05-4/","https://codeberg.org/bookstack/bookstack/releases/tag/v26.05.4","https://github.com/BookStackApp/BookStack/releases/tag/v26.05.4","https://www.vulncheck.com/advisories/bookstack-broken-access-control-via-image-gallery-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-67204","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-24T17:20:05.562340Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-24T17:20:18.693Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-01T15:20:17.762Z"}}},"related_cves":[{"value":"CVE-2026-67204","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ef813876-a43b-4f24-9eb3-3bbd97c87424","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-67204","advisory_id":"ef813876-a43b-4f24-9eb3-3bbd97c87424","event_types":["advisory"],"published_at":"2026-10-24T22:08:09.678905+00:00","technologies":["bookstack","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-24T15:33:13.649+00:00","detail_url":"/advisories/advisory%3Aef813876-a43b-4f24-9eb3-3bbd97c87424","group":{"id":"advisory:ef813876-a43b-4f24-9eb3-3bbd97c87424","revision":1,"primary_event_id":5452,"change":"published","superseded_by":[],"changed":{"id":5452,"cve_ids":["CVE-2026-67204"],"payload":{"kind":"advisory","title":"BookStack < 26.05.4 Broken Access Control via Image Gallery API","summary":"BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a user avatar's ID to the API controller, which loads any image type without the web controller's gallery and drawio restrictions, and when the avatar's uploaded_to field matches a page ID accessible to the attacker, the authorization check passes allowing the attacker to rename, replace, or delete the target user's avatar without requiring user-management permission.","evidence":"cve:CVE-2026-67204","products":[{"name":{"value":"BookStack","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-67204","aliases":["CVE-2026-67204"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/BookStackApp/BookStack","vendor":"BookStackApp","product":"BookStack","versions":[{"status":"affected","version":"0","lessThan":"26.05.4","versionType":"custom"}],"packageURL":"pkg:github/BookStackApp/BookStack","defaultStatus":"affected"}],"modified":"2026-10-01T15:20:17.762Z","provider":"cve","references":["https://www.bookstackapp.com/blog/bookstack-release-v26-05-4/","https://codeberg.org/bookstack/bookstack/releases/tag/v26.05.4","https://github.com/BookStackApp/BookStack/releases/tag/v26.05.4","https://www.vulncheck.com/advisories/bookstack-broken-access-control-via-image-gallery-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-67204","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-24T17:20:05.562340Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-24T17:20:18.693Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-01T15:20:17.762Z"}}},"related_cves":[{"value":"CVE-2026-67204","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ef813876-a43b-4f24-9eb3-3bbd97c87424","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-67204","advisory_id":"ef813876-a43b-4f24-9eb3-3bbd97c87424","event_types":["advisory"],"published_at":"2026-10-24T22:08:09.678905+00:00","technologies":["bookstack","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-24T15:33:13.649+00:00","detail_url":"/events/5452"},"members":[{"id":5452,"cve_ids":["CVE-2026-67204"],"payload":{"kind":"advisory","title":"BookStack < 26.05.4 Broken Access Control via Image Gallery API","summary":"BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a user avatar's ID to the API controller, which loads any image type without the web controller's gallery and drawio restrictions, and when the avatar's uploaded_to field matches a page ID accessible to the attacker, the authorization check passes allowing the attacker to rename, replace, or delete the target user's avatar without requiring user-management permission.","evidence":"cve:CVE-2026-67204","products":[{"name":{"value":"BookStack","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-67204","aliases":["CVE-2026-67204"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/BookStackApp/BookStack","vendor":"BookStackApp","product":"BookStack","versions":[{"status":"affected","version":"0","lessThan":"26.05.4","versionType":"custom"}],"packageURL":"pkg:github/BookStackApp/BookStack","defaultStatus":"affected"}],"modified":"2026-10-01T15:20:17.762Z","provider":"cve","references":["https://www.bookstackapp.com/blog/bookstack-release-v26-05-4/","https://codeberg.org/bookstack/bookstack/releases/tag/v26.05.4","https://github.com/BookStackApp/BookStack/releases/tag/v26.05.4","https://www.vulncheck.com/advisories/bookstack-broken-access-control-via-image-gallery-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-67204","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-24T17:20:05.562340Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-24T17:20:18.693Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-01T15:20:17.762Z"}}},"related_cves":[{"value":"CVE-2026-67204","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ef813876-a43b-4f24-9eb3-3bbd97c87424","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-67204","advisory_id":"ef813876-a43b-4f24-9eb3-3bbd97c87424","event_types":["advisory"],"published_at":"2026-10-24T22:08:09.678905+00:00","technologies":["bookstack","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-24T15:33:13.649+00:00","detail_url":"/events/5452"}]}}],"next_after":56300,"next_before":5429}