CVE-2026-67204: BookStack Auth Bypass Vulnerability

CVE-2026-67204 Overview

CVE-2026-67204 is a broken access control vulnerability [CWE-863] in BookStack versions prior to 26.05.4. The flaw resides in the Image Gallery API endpoints, which fail to enforce content-type restrictions applied by the corresponding web controller. Authenticated API users holding image-update or image-delete permissions can supply another user's avatar image ID to the API controller. Because the avatar's uploaded_to field references a page ID accessible to the attacker, the authorization check passes. The attacker can then rename, replace, or delete the target user's avatar without possessing user-management permission.

Critical Impact
Authenticated attackers with basic image permissions can manipulate arbitrary users' avatars through the API, bypassing user-management authorization controls.

Affected Products

BookStack versions before 26.05.4
BookStack instances exposing the Image Gallery API to authenticated users
Deployments granting image-update or image-delete permissions to non-administrative roles

Discovery Timeline

2026-08-24 - CVE-2026-67204 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-67204

Vulnerability Analysis

The vulnerability stems from inconsistent authorization logic between the BookStack web controller and its API counterpart for image management. The web-facing controller restricts image operations to specific content types, namely gallery and drawio images, preventing manipulation of user avatars through gallery endpoints. The API controller omits this content-type check. When an authenticated API user submits an image ID belonging to another user's avatar, the controller loads the image regardless of its type. Authorization is then evaluated based on the image's uploaded_to field, which for avatars maps to a page the attacker may legitimately access. The resulting authorization decision grants access to a resource that should require user-management privileges.

Root Cause

The root cause is a missing authorization constraint [CWE-863] in the Image Gallery API endpoints. The API path lacks the content-type filter present on the web controller path, creating divergent access control policies for equivalent operations.

Attack Vector

Exploitation requires an authenticated API session with image-update or image-delete permissions. The attacker identifies a target avatar's image ID, then issues an API request referencing that ID. Because avatars are linked to a page accessible to the attacker, the authorization check succeeds. The attacker can rename, replace image content, or delete the avatar entirely. No user interaction is required from the target.

No verified proof-of-concept code has been published. Refer to the VulnCheck Advisory on BookStack Access Control for additional technical details.

Detection Methods for CVE-2026-67204

Indicators of Compromise

Unexpected changes to user avatar images, including renamed, replaced, or missing avatars across accounts
API requests to Image Gallery endpoints referencing image IDs that resolve to user avatars rather than page gallery content
PUT or DELETE requests against /api/image-gallery/{id} originating from accounts without user-management roles

Detection Strategies

Correlate BookStack API access logs with image metadata to flag operations targeting images whose type is user rather than gallery or drawio
Alert on API image-modification activity performed by accounts whose role does not include user-management permission
Baseline avatar file hashes and monitor for unauthorized replacement events

Monitoring Recommendations

Enable verbose API audit logging for all Image Gallery endpoints and forward records to a central log platform
Track ratios of API image operations per user role and alert on statistical deviations
Review BookStack activity logs for image_update and image_delete events referencing avatar image IDs

How to Mitigate CVE-2026-67204

Immediate Actions Required

Upgrade BookStack to version 26.05.4 or later as documented in the BookStack Blog Release v26.05.4
Audit user roles and revoke image-update and image-delete permissions from accounts that do not require them
Review recent API activity for image operations targeting avatar image IDs and restore any tampered avatars

Patch Information

BookStack 26.05.4 introduces the missing content-type restriction in the Image Gallery API controller, aligning API authorization with the web controller. Release artifacts are available at the GitHub BookStack Release v26.05.4 and the Codeberg BookStack Release v26.05.4.

Workarounds

Restrict access to the BookStack API at the network layer for roles that do not require programmatic image management
Temporarily remove image-update and image-delete permissions from custom roles until the upgrade to 26.05.4 is completed
Place BookStack behind a reverse proxy that enforces path-based access controls on /api/image-gallery/* endpoints

bash

# Configuration example
# See vendor release notes for upgrade steps: https://www.bookstackapp.com/blog/bookstack-release-v26-05-4/