BookStack before 26.09.3 Incorrect Authorization via Image and Drawio Endpoints
Summary
| CVE | CVE-2026-126811 |
|---|---|
| State | PUBLISHED |
| Assigner | VulnCheck |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-11 21:16:45 UTC |
| Updated | 2026-11-12 20:28:31 UTC |
| Description | BookStack before 26.09.3 contains an incorrect authorization vulnerability that allows authenticated users to access other users' unpublished draft page images by checking only PageView permission without draft status. Attackers can read drawio data via the base64 endpoint or rename, replace, or delete draft images by sequential ID to disclose or tamper with unpublished work. |
Risk And Classification
Primary CVSS: v4.0 5.3 MEDIUM from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-863 | CWE-863 Incorrect Authorization
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 5.3 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 5.3 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
| 3.1 | [email protected] | Secondary | 5.4 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| 3.1 | CNA | CVSS | 5.4 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowAttack Requirements
NonePrivileges Required
LowUser Interaction
NoneConfidentiality
LowIntegrity
LowAvailability
NoneSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
LowIntegrity
LowAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | BookStackApp | BookStack | affected 26.09.3 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/BookStackApp/BookStack/commit/926e16a23f346be47d44746d14cba40... | [email protected] | github.com | |
| github.com/BookStackApp/BookStack/blob/v26.09.2/app/Uploads/Controllers/... | [email protected] | github.com | |
| codeberg.org/bookstack/bookstack/releases/tag/v26.09.3 | [email protected] | codeberg.org | |
| www.vulncheck.com/advisories/bookstack-before-26.09.3-incorrect-authorization-v... | [email protected] | www.vulncheck.com | |
| www.bookstackapp.com/blog/bookstack-release-v26-09-3 | [email protected] | www.bookstackapp.com | |
| github.com/fishtankyu/bookstack-draft-image-idor-advisory.md | [email protected] | github.com | |
| codeberg.org/bookstack/bookstack/commit/926e16a23f346be47d44746d14cba40cb3... | [email protected] | codeberg.org | |
| github.com/BookStackApp/BookStack/releases/tag/v26.09.3 | [email protected] | github.com | |
| codeberg.org/bookstack/bookstack/commit/4fec06236cbfb314fd72c1b3614c7c5016... | [email protected] | codeberg.org | |
| github.com/BookStackApp/BookStack/blob/v26.09.2/app/Uploads/Controllers/... | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Zeng Yu (en)
There are currently no legacy QID mappings associated with this CVE.