MEDIUM 5.3 NVD
CVE-2026-116020
BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft
BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or replace files on another user's unpublished draft pages.
References
- https://codeberg.org/bookstack/bookstack/commit/fcadecccda706b4ecaf9ac3f8e27defe0ebe78ae
- https://codeberg.org/bookstack/bookstack/releases/tag/v26.09.2
- https://codeberg.org/bookstack/bookstack/src/tag/v26.09.1/app/Uploads/Controllers/Attachme
- https://www.bookstackapp.com/blog/bookstack-release-v26-09-2/
- https://www.vulncheck.com/advisories/bookstack-before-26.09.2-incorrect-authorization-via-
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-24 via NVD.
vulnfeed aggregates 15909 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.