Incorrect Authorization in BookStack Allows Unauthorized Access to Draft Attachments

CVE-2026-116020

What is CVE-2026-116020?

BookStack versions prior to 26.09.2 are susceptible to an incorrect authorization vulnerability in the AttachmentController. This issue allows authenticated users who have attachment permissions to skillfully access other users’ draft page attachments by exploiting sequential attachment IDs. Once attackers gain this access, they can download, rename, relink, or even replace files associated with another user’s unpublished drafts, potentially leading to significant privacy breaches and data manipulation.

References