What’s Vulnerable › Vulnerabilities

CVE-2024-36676

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-09 · updated 2026-06-17
• Weakness: CWE-79

Description

Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms.

Affected products

• bookstackapp/bookstack: before v24.05.1 — fixed in v24.05.1

How to fix

Upgrade to a fixed version: bookstackapp/bookstack v24.05.1. Check the vendor advisory for mitigations.

References

• https://github.com/BookStackApp/BookStack/issues/4993
• https://github.com/BookStackApp/BookStack/releases/tag/v24.05.1
• https://www.bookstackapp.com/blog/bookstack-release-v24-05-1/
• https://github.com/BookStackApp/BookStack/issues/4993
• https://github.com/BookStackApp/BookStack/releases/tag/v24.05.1
• https://www.bookstackapp.com/blog/bookstack-release-v24-05-1/

Get alerted when CVE-2024-36676 or the next vulnerability affects your stack