CVE-2026-126811: BookStack before 26.09.3 Incorrect Authorization via Image and Drawio Endpoints
BookStack before 26.09.3 contains an incorrect authorization vulnerability that allows authenticated users to access other users' unpublished draft page images by checking only PageView permission without draft status. Attackers can read drawio data via the base64 endpoint or rename, replace, or delete draft images by sequential ID to disclose or tamper with unpublished work.
Event History
Frequently Asked Questions
Which users are exposed to this issue?
Authenticated users who have PageView permission can access unpublished draft page images belonging to other users. The issue affects BookStack versions before 26.09.3.
What could an attacker do with access to the affected endpoints?
An attacker can read Drawio data through the base64 endpoint. By enumerating sequential image IDs, they can also rename, replace, or delete images attached to unpublished draft pages.
Is user interaction or elevated privileges required?
No user interaction is required. Exploitation requires an authenticated account with PageView permission; no higher privilege requirement is indicated.