Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')