GHSA-pj36-fcrg-327j

BookStack Incorrect Access Control vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-36676

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	ssddanbrown/bookstack	< 24.05.1	24.05.1

Details

As written in the advisory (Markdown source, shown as plain text).

Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-36676 advisory
https://github.com/BookStackApp/BookStack/issues/4993 web
https://github.com/BookStackApp/BookStack/commit/69af9e0dbdefd8c6c951e8afbe2bba141d454beb web
https://github.com/BookStackApp/BookStack package
https://github.com/BookStackApp/BookStack/releases/tag/v24.05.1 web
https://www.bookstackapp.com/blog/bookstack-release-v24-05-1 web