CVE-2026-116020
BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 24, 2026
- Updated
- Oct 24, 2026
- Reserved
- Oct 24, 2026
Description
BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or replace files on another user's unpublished draft pages.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
BookStackBookStackApp |
|
References
- https://codeberg.org/bookstack/bookstack/commit/fcadecccda706b4ecaf9ac3f8e27defe0ebe78aepatch
- https://www.bookstackapp.com/blog/bookstack-release-v26-09-2/vendor-advisoryrelease-notes
- https://codeberg.org/bookstack/bookstack/releases/tag/v26.09.2release-notes
- https://codeberg.org/bookstack/bookstack/src/tag/v26.09.1/app/Uploads/Controllers/AttachmentController.phptechnical-description
- VulnCheck Advisory: BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pagesthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.