Threats tagged 'ghsa-gx3w-9hmm-83wm'

BookStack versions prior to 26.09.3 have an authorization vulnerability that allows authenticated users to access or manipulate other users' unpublished draft page images. The flaw arises because the system only checks PageView permission without verifying draft status, enabling attackers to read or tamper with draft images via sequential IDs.