Missing Authorization Vulnerability in BookStack ImageController
CVE-2026-125870

2.3LOW

Key Information:

Vendor

Bookstackapp

Status
Bookstack
Vendor
CVE Published:
12 November 2026

What is CVE-2026-125870?

BookStack versions prior to 26.09.3 are subject to a vulnerability within the ImageController that allows authenticated non-admin users to bypass page-level content restrictions. This occurs as the permission check for images associated with soft-deleted pages fails, which can lead to unauthorized access to restricted image metadata. Attackers can exploit this flaw by enumerating image IDs, granting them the ability to view sensitive content and manipulate images—potentially leading to unauthorized renaming, replacement, or permanent deletion of images, causing lasting damage even after the page is restored.

Affected Version(s)

bookstack 0 < 26.09.3

References

https://codeberg.org/bookstack/bookstack/releases/tag/v26...
patch
https://github.com/BookStackApp/BookStack/releases/tag/v2...
patch
https://www.bookstackapp.com/blog/bookstack-release-v26-0...
vendor-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

CayCon
.