CVE-2021-4026

bookstack is vulnerable to Improper Access Control

• CWE-284
• CWE-863

• https://github.com/bookstackapp/bookstack/commit/b4fa82e3298a15443ca40bff205b7a16a1031d92Patch, Third Party Advisory
• https://huntr.dev/bounties/c6dfa80d-43e6-4b49-95af-cc031bb66b1dExploit, Third Party Advisory
• https://github.com/bookstackapp/bookstack/commit/b4fa82e3298a15443ca40bff205b7a16a1031d92Patch, Third Party Advisory
• https://huntr.dev/bounties/c6dfa80d-43e6-4b49-95af-cc031bb66b1dExploit, Third Party Advisory

Published

Nov 30, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-4023A flaw was found in the io-workqueue implementation in the L…5.5
• CVE-2021-40238A Cross Site Scriptiong (XSS) vulnerability exists in the ad…6.1
• CVE-2021-40239A Buffer Overflow vulnerability exists in the latest version…9.8
• CVE-2021-4024A flaw was found in podman. The `podman machine` function (u…6.5
• CVE-2021-40241xfig 3.2.7 is vulnerable to Buffer Overflow.9.8
• CVE-2021-40247SQL injection vulnerability in Sourcecodester Budget and Exp…9.8
• CVE-2021-40260Multiple Cross Site Scripting (XSS) vulnerabilities exist in…6.1
• CVE-2021-40261Multiple Cross Site Scripting (XSS) vulnerabilities exist in…6.1
• CVE-2021-40262A stack exhaustion issue was discovered in FreeImage before …6.5
• CVE-2021-40263A heap overflow vulnerability in FreeImage 1.18.0 via the of…8.8
• CVE-2021-40264NULL pointer dereference vulnerability in FreeImage before 1…6.5
• CVE-2021-40265A heap overflow bug exists FreeImage before 1.18.0 via ofLoa…8.8