Medium severity5.4NVD Advisory· Published Oct 24, 2026
CVE-2026-116020
CVE-2026-116020
Description
BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or replace files on another user's unpublished draft pages.
Affected products
1- Range: <26.09.2
Patches
Vulnerability mechanics
References
4- codeberg.org/bookstack/bookstack/commit/fcadecccda706b4ecaf9ac3f8e27defe0ebe78aenvd
- codeberg.org/bookstack/bookstack/releases/tag/v26.09.2nvd
- www.bookstackapp.com/blog/bookstack-release-v26-09-2/nvd
- www.vulncheck.com/advisories/bookstack-before-26.09.2-incorrect-authorization-via-attachmentcontroller-on-draft-pagesnvd
News mentions
0No linked articles in our index yet.