CVE-2021-4119
Improper Access Control in bookstackapp/bookstack
bookstack is vulnerable to Improper Access Control
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Improper Access Control in bookstackapp/bookstack
bookstack is vulnerable to Improper Access Control
- Record
CVE-2021-4119- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2021-2494
bookstack is vulnerable to Improper Access Control
- Record
EUVD-2021-2494- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9c5c-5j4h-8q2c
BookStack is vulnerable to Improper Access Control.
BookStack prior to version 21.11.3 is vulnerable to Improper Access Control. A logged-in user with no privileges OR guest user (if public access enabled) can access the /search/users/select AJAX endpoint meant for admins to manage audit logs, to dump all usernames existing in the Bookstack database. This can also be used to harvest email belonging to a user because BookStack also uses the code where(email, like, % . $search . %) to search for users based on email.
- Record
GHSA-9c5c-5j4h-8q2c- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
NVD
bookstack is vulnerable to Improper Access Control
- Record
CVE-2021-4119- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
bookstack is vulnerable to Improper Access Control
- Record
CVE-2021-4119- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-9c5c-5j4h-8q2c
BookStack is vulnerable to Improper Access Control.
BookStack prior to version 21.11.3 is vulnerable to Improper Access Control. A logged-in user with no privileges OR guest user (if public access enabled) can access the /search/users/select AJAX endpoint meant for admins to manage audit logs, to dump all usernames existing in the Bookstack database. This can also be used to harvest email belonging to a user because BookStack also uses the code where(email, like, % . $search . %) to search for users based on email.
- Record
GHSA-9c5c-5j4h-8q2c- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ssddanbrown/bookstackPackagist |
before 21.11.3 | 21.11.3 |
ssddanbrown/bookstackPackagist |
before 21.11.3, plus listed versions 0.7.2V0.7.5v0.10.0v0.11.0v0.11.1 Show 45 moreShow lessv0.11.2v0.12.0v0.12.1v0.12.2v0.13.0v0.13.1v0.14.0v0.14.1v0.14.2v0.14.3v0.15.0v0.15.1v0.15.2v0.15.3v0.16.0v0.16.1v0.16.2v0.16.3v0.17.0v0.17.1v0.17.2v0.17.3v0.17.4v0.18.0v0.18.1v0.18.2v0.18.3v0.18.4v0.18.5v0.19.0v0.20.0v0.20.1v0.20.2v0.20.3v0.21.0v0.22.0v0.23.0v0.23.1v0.23.2v0.24.0v0.24.1v0.24.2v0.24.3v0.25.0v0.25.1 |
21.11.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-4119 is a medium vulnerability (CVSS 5.3) in Bookstackapp Bookstack, published December 15, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 26.9%, the 98th percentile. Fixed in ssddanbrown/bookstack 21.11.3.
References
huntr.dev/bounties/135f2d7d-ab0b-4351-99b9-889efac46fca
github.com/bookstackapp/bookstack/commit/e765e618547c92f4e0b46caca6fb91f0174efd99
nvd.nist.gov/vuln/detail/CVE-2021-4119
Left out here: 82 versions. The JSON record has them.