BookStack versions before 26.05.5 contain a flaw in the social to authenticate as any existing user. By selecting a social provider that is enabled and providing a user ID that matches an account linked to a different provider, the system ignores the provider type when looking up the linked account, effectively bypassing credential verification. The result is that anyone can obtain the privileges of any user with only a matching driver ID, giving full access to content, administrative functions, and potentially sensitive configuration data.

The vulnerability affects the BookStack application from bookstackapp:bookstack. All installations running a version earlier than 26.05.5 are susceptible; newer releases incorporate the fix. No specific version numbers beyond the cutoff are listed in the CNA data.

The CVSS score of 9.1 indicates critical severity, and the EPSS score of < 1% indicates a very low but non‑zero likelihood of exploitation. The lack of mitigation in older releases means that, if an attacker has knowledge of a valid driver ID and can use an enabled social provider, they can bypass authentication. The flaw is an authentication bypass, a high‑impact type of weakness (CWE‑290). Attackers need only knowledge of a valid driver ID and access to a separate, enabled social provider; there are no prerequisites beyond the existence of the social login feature. The vulnerability is not currently cataloged in CISA KEV, but its severity warrants immediate attention.