CVE-2026-89022

BookStack versions before 26.05.5 contain an authentication bypass (CWE-290) in the social login implementation: the SocialAuthService::handleLoginCallback lookup matches a linked social account on the user ID alone and ignores the driver column. An unauthenticated attacker who authenticates at any enabled social provider using an ID that collides with an account linked to a different provider is signed in as that BookStack user, bypassing credential verification entirely. Successful exploitation gives full access to the targeted victim's account, including any documents, drafts, and permissions that user holds, up to and including admin accounts. Instances are only exposed if two or more social authentication providers sharing the same driver_id namespace are enabled (for example multiple OAuth providers). No public proof-of-concept exists and the flaw is not in CISA's KEV catalog, so exploitation is currently assessed as none known.

What to do: Upgrade to BookStack 26.05.5 or later, which fixes the driver-scoped lookup in SocialAuthService::handleLoginCallback. If immediate patching is not possible, disable social login entirely or reduce it to a single enabled provider so no cross-provider driver_id collision is possible. Audit the oauth_access_tokens/social account links in the database for unexpected provider associations and review authentication logs for logins via providers a user never legitimately used.