CVE-2026-116020

BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or replace files on another user's unpublished draft pages.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://codeberg.org/bookstack/bookstack/commit/fcadecccda706b4ecaf9ac3f8e27defe0ebe78ae
https://codeberg.org/bookstack/bookstack/releases/tag/v26.09.2
https://codeberg.org/bookstack/bookstack/src/tag/v26.09.1/app/Uploads/Controllers/AttachmentController.php
https://www.bookstackapp.com/blog/bookstack-release-v26-09-2/
https://www.vulncheck.com/advisories/bookstack-before-26.09.2-incorrect-authorization-via-attachmentcontroller-on-draft-pages

Configurations

No configuration.

History

24 Oct 2026, 12:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-24 12:16

Updated : 2026-10-26 18:39

NVD link : CVE-2026-116020

Mitre link : CVE-2026-116020

CVE.ORG link : CVE-2026-116020

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-116020", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://codeberg.org/bookstack/bookstack", "vendor": "BookStackApp", "product": "BookStack", "versions": [{"status": "affected", "version": "0", "lessThan": "26.09.2", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-24T12:16:58.660", "references": [{"url": "https://codeberg.org/bookstack/bookstack/commit/fcadecccda706b4ecaf9ac3f8e27defe0ebe78ae", "source": "disclosure@vulncheck.com"}, {"url": "https://codeberg.org/bookstack/bookstack/releases/tag/v26.09.2", "source": "disclosure@vulncheck.com"}, {"url": "https://codeberg.org/bookstack/bookstack/src/tag/v26.09.1/app/Uploads/Controllers/AttachmentController.php", "source": "disclosure@vulncheck.com"}, {"url": "https://www.bookstackapp.com/blog/bookstack-release-v26-09-2/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/bookstack-before-26.09.2-incorrect-authorization-via-attachmentcontroller-on-draft-pages", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or replace files on another user's unpublished draft pages."}], "lastModified": "2026-10-26T18:39:42.503", "sourceIdentifier": "disclosure@vulncheck.com"}