CVE-2026-86285: Improper Access Controls in BookStack

This vulnerability affects the Attachment Edit Endpoint in BookStack, specifically the AttachmentController::getUpdateForm function in app/Uploads/Controllers/AttachmentController.php. Improper access control occurs due to manipulation of the ID argument, enabling unauthorized access to update forms. The vulnerability is remotely exploitable without user interaction and requires low privileges. The CVSS 4.0 score is 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. A patch is available as identified by the commit hash 4e406c41c4c8060a5795e74c66fb96362e54f400.

Successful exploitation allows remote attackers to bypass access controls on the attachment update form, potentially leading to unauthorized access or modification of attachments. The impact on confidentiality, integrity, and availability is low, but unauthorized access could lead to information disclosure or unauthorized changes to attachments within BookStack.

A patch identified by commit 4e406c41c4c8060a5795e74c66fb96362e54f400 is available and should be applied promptly to affected versions 26.05.0, 26.05.1, and 26.05.2. Implementing this official fix will correct the improper access control issue. No additional mitigation steps are indicated by the vendor advisory.