BookStack Incorrect Access Control vulnerability

ALTO 7.5CVE-2024-36676 · GHSA-pj36-fcrg-327j · Published 09/07/2024 · updated 17/06/2026

Em resumo

CVE-2024-36676 é uma vulnerabilidade ALTO (CVSS 7.5) que afeta ssddanbrown/bookstack.
Chance de exploração nos próximos 30 dias (EPSS): 0.65%, maior que 51.0% das vulnerabilidades.
Correção: atualize para 24.05.1 ou posterior.

Package	Affected versions	Patched versions
ssddanbrown/bookstack Packagist	`< 24.05.1`	`24.05.1`

Description

Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms.

NVD description

Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms.

References

nvd.nist.gov/vuln/detail/CVE-2024-36676 · ADVISORY
BookStackApp/BookStack · WEB
BookStackApp/BookStack commit 69af9e0 · WEB
BookStackApp/BookStack · PACKAGE
BookStackApp/BookStack release v24.05.1 · WEB
bookstackapp.com/blog/bookstack-release-v24-05-1 · WEB
bookstackapp.com/blog/bookstack-release-v24-05-1

Mais vulnerabilidades de ssddanbrown/bookstack

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

ssddanbrown/bookstack

Packagist

< 24.05.1

24.05.1

Description

Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms.

NVD description

Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms.

Mais vulnerabilidades de ssddanbrown/bookstack

Ver tudo →