CVE-2026-67204 BookStackApp CVE debrief

Who should care

Defenders responsible for BookStack instances, API security, and user authentication should assess exposure and apply patches or mitigations to prevent unauthorized avatar manipulation.

Why it matters

CVE-2026-67204 is a broken access control vulnerability in BookStack that allows authenticated API users to manipulate other users' avatars. Defenders should prioritize verifying exposure and applying patches or mitigations to prevent unauthorized avatar manipulation.

• Verify exposure and apply patches or mitigations to prevent unauthorized avatar manipulation.
• Restrict image-update and image-delete permissions to trusted API users.
• Monitor API activity for suspicious image updates or deletions.

Technical summary

The vulnerability allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. This is possible when the avatar's uploaded_to field matches a page ID accessible to the attacker, allowing the attacker to rename, replace, or delete the target user's avatar without requiring user-management permission. The vulnerability is in BookStack before version 26.05.4 and defenders should prioritize verifying exposure and applying patches or mitigations.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or mitigations to prevent unauthorized avatar manipulation.

Recommended defensive actions

• Verify exposure by checking if the BookStack instance is running a vulnerable version and if API users have image-update or image-delete permissions.
• Apply patches or mitigations to prevent unauthorized avatar manipulation.
• Monitor API activity for suspicious image updates or deletions.
• Restrict image-update and image-delete permissions to trusted API users.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is described in the CVE record and NVD entry. The vendor has released a patched version (26.05.4) and provided additional information on their website. Evidence is limited to public CVE and NVD information. Defenders should verify exposure by checking if the BookStack instance is running a vulnerable version and if API users have image-update or image-delete permissions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.