high8.2
CVE-2024-36676
BookStack Incorrect Access Control vulnerability
Impact
Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | ssddanbrown/bookstack | < 24.05.1 | 24.05.1 |
Affected products
| Product | Affected versions |
|---|---|
| BookStack | before 24.05.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/BookStackApp/BookStack/issues/4993
- https://github.com/BookStackApp/BookStack/releases/tag/v24.05.1
- https://www.bookstackapp.com/blog/bookstack-release-v24-05-1/
- https://github.com/advisories/GHSA-pj36-fcrg-327j
- https://nvd.nist.gov/vuln/detail/CVE-2024-36676
- https://www.bookstackapp.com/blog/bookstack-release-v24-05-1
- https://github.com/BookStackApp/BookStack/commit/69af9e0dbdefd8c6c951e8afbe2bba141d454beb