Authorization Flaw in BookStack Leading to Exposure of Unpublished Draft Images

CVE-2026-126811

What is CVE-2026-126811?

The BookStack application prior to version 26.09.3 is susceptible to an incorrect authorization vulnerability. This issue allows authenticated users to gain unauthorized access to unpublished draft page images. By merely having PageView permissions, users can exploit this flaw without needing the necessary draft status. Specifically, attackers can retrieve drawio data through the base64 endpoint, and they have the ability to rename, replace, or delete draft images using sequential IDs. This can lead to unauthorized disclosure or modifications of unpublished work, posing significant privacy concerns for affected users.

References