BookStack Incorrect Access Control vulnerability

HOCH 7.5CVE-2024-36676 · GHSA-pj36-fcrg-327j · Published 09/07/2024 · updated 17/06/2026

Kurz gesagt

CVE-2024-36676 ist eine Schwachstelle (HOCH (CVSS 7.5)) in ssddanbrown/bookstack.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.65%, höher als bei 51.0% aller Schwachstellen.
Abhilfe: auf 24.05.1 oder neuer aktualisieren.

Package	Affected versions	Patched versions
ssddanbrown/bookstack Packagist	`< 24.05.1`	`24.05.1`

Description

Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms.

NVD description

Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms.

References

nvd.nist.gov/vuln/detail/CVE-2024-36676 · ADVISORY
BookStackApp/BookStack · WEB
BookStackApp/BookStack commit 69af9e0 · WEB
BookStackApp/BookStack · PACKAGE
BookStackApp/BookStack release v24.05.1 · WEB
bookstackapp.com/blog/bookstack-release-v24-05-1 · WEB
bookstackapp.com/blog/bookstack-release-v24-05-1

Weitere Schwachstellen in ssddanbrown/bookstack

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

ssddanbrown/bookstack

Packagist

< 24.05.1

24.05.1

Description

Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms.

NVD description

Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms.

Weitere Schwachstellen in ssddanbrown/bookstack

Alle anzeigen →