Improper Access Control in BookStack Affects Attachment Edit Functionality
CVE-2026-86285

5.3MEDIUM

Key Information:

Vendor

BookStack

Status
Bookstack
Vendor
CVE Published:
7 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-86285?

A vulnerability has been identified in BookStack impacting versions up to 26.05.2, specifically within the Attachment Edit Endpoint's AttachmentController.php file. The flaw resides in the function AttachmentController::getUpdateForm, where improper access control mechanisms are in place. This vulnerability could allow an attacker to manipulate the argument ID, potentially gaining unauthorized access to sensitive attachment data. This issue is remotely exploitable and has been made public, underscoring the necessity for users to apply the recommended patch (commit ID: 4e406c41c4c8060a5795e74c66fb96362e54f400) to safeguard against potential exploitation.

Affected Version(s)

BookStack 26.05.0

BookStack 26.05.1

BookStack 26.05.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-86285 - Proof of Concept

References

https://vuldb.com/vuln/399445
vdb-entrytechnical-description
https://vuldb.com/vuln/399445/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-86285
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

MAVERICK-VF142 (VulDB User)
.