CVE-2026-86285: BookStack Attachment Edit Endpoint AttachmentController.php getUpdateForm access control
A vulnerability was detected in BookStack up to 26.05.2. Affected by this issue is the function AttachmentController::getUpdateForm of the file app/Uploads/Controllers/AttachmentController.php of the component Attachment Edit Endpoint. The manipulation of the argument ID results in improper access controls. The attack may be launched remotely. The exploit is now public and may be used. The patch is identified as 4e406c41c4c8060a5795e74c66fb96362e54f400. It is advisable to implement a patch to correct this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BookStackto a version that resolves this vulnerability.Fixed in 26.05.2Patch 4e406c41c4c8060a5795e74c66fb96362e54f400
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a valid low-privilege account, since exploitation requires privileges (PR:L). The attack can be performed remotely and does not require user interaction.
What is the likely impact of successful exploitation?
The issue allows improper access control through manipulation of an attachment ID in the attachment edit endpoint. The supplied severity vector indicates a limited confidentiality impact, with no indicated integrity or availability impact.
How should teams prioritize remediation?
Apply the vendor-identified patch, commit 4e406c41c4c8060a5795e74c66fb96362e54f400. The exploit is public, so systems running affected BookStack versions up to 26.05.2 should be prioritized.