CVE-2026-116020VulnerabilityPublished 10/24/2026
CVE-2026-116020: Incorrect Authorization in BookStackApp BookStack
Affects BookStackApp BookStackSource CVE Database V5
CVSS 4.0 base score
5.3Medium
- Exploitation
Not in CISA KEV, no exploitation reported
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:NWhat to do
AI-suggested
A fix is available in BookStack version 26.09.2. Users should upgrade to version 26.09.2 or later to remediate this authorization vulnerability.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| BookStackAppBookStack | Affected
| Fixed in
|
GitHub Actionsbookstack/bookstackpkg:github/bookstack/bookstackOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
BookStack versions before 26.09.2 have an authorization vulnerability in the AttachmentController that allows authenticated users with attachment permissions to access draft page attachments of other users by enumerating attachment IDs. This can lead to unauthorized downloading, renaming, relinking, or replacing of files on unpublished draft pages.
References
- codeberg.org/bookstack/bookstack/commit/fcadecccda706b4ecaf9ac3f8e27defe0ebe78ae (opens in a new tab)
- bookstackapp.com/blog/bookstack-release-v26-09-2/ (opens in a new tab)
- codeberg.org/bookstack/bookstack/releases/tag/v26.09.2 (opens in a new tab)
- codeberg.org/bookstack/bookstack/src/tag/v26.09.1/app/Uploads/Controllers/AttachmentController.php (opens in a new tab)
- vulncheck.com/advisories/bookstack-before-26.09.2-incorrect-authorization-via-attachmentcontroller-on-draft-pages (opens in a new tab)