Description

BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a user avatar's ID to the API controller, which loads any image type without the web controller's gallery and drawio restrictions, and when the avatar's uploaded_to field matches a page ID accessible to the attacker, the authorization check passes allowing the attacker to rename, replace, or delete the target user's avatar without requiring user-management permission.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-24T16:17:17.790Z",
  "pubdate": "2026-08-24T16:17:17.790Z",
  "executiveSummary": "BookStack before 26.05.4 suffers from a broken access control vulnerability residing within the Image Gallery API endpoints.\nThe flaw stems from missing content-type restrictions and improper authorization enforcement during image manipulation operations.\nAuthenticated API users possessing image-update or image-delete permissions can leverage this vulnerability to manipulate, rename, replace, or delete arbitrary user avatars without possessing administrative or user-management privileges.\nThe attack is successfully executed by supplying a targeted user avatar's ID to the API controller, bypassing standard web controller gallery and drawio restrictions.\nExploitation requires the avatar's uploaded_to field to coincide with a page ID that is accessible to the attacker, satisfying the flawed authorization check.\nThe business impact includes unauthorized modification of user profiles, potential user impersonation vectors, and integrity degradation of system identity data.\nRisk implications are moderate to high depending on the privilege boundaries within the targeted BookStack deployment, as authenticated users can escalate their scope of control over user assets beyond their assigned role limitations.",
  "technicalDetails": "The root cause of the vulnerability resides in the Image Gallery API endpoints of BookStack before 26.05.4, which fail to properly enforce content-type restrictions and execute rigorous authorization validation when handling image manipulation requests.\nUnlike the web application controller, which enforces strict gallery and drawio constraints, the API controller insufficiently validates the context and intended target of image update and delete requests.\nPrivilege requirements mandate that the attacker must be an authenticated API user with baseline image-update or image-delete permissions, though they do not require user-management privileges.\nThe attack flow begins when an authenticated attacker identifies the resource ID of a victim's user avatar.\nThe attacker crafts an API request directed at the Image Gallery API endpoints, supplying the targeted user avatar's ID to the vulnerable controller.\nTo satisfy the flawed authorization check, the attacker ensures that the avatar's uploaded_to database field matches a page ID that is currently accessible to the attacker's authorization scope.\nBecause the authorization logic incorrectly validates against the associated page ID rather than enforcing strict ownership or administrative boundaries, the authorization check passes successfully.\nOnce the check is bypassed, the underlying payload behavior allows the attacker to execute operations such as renaming, replacing, or outright deleting the target user's avatar.\nPost-exploitation impact includes unauthorized defacement or modification of user profiles across the affected BookStack instance, potentially facilitating social engineering or targeted user confusion.\nThe affected component is the Image Gallery API handling mechanism in BookStack versions prior to 26.05.4."
}