CVE-2026-116020
Received Received - Intake

Incorrect Authorization in BookStack Allows Draft Attachment Access

Publication date: 2026-10-24

Last updated on: 2026-10-24

Assigner: VulnCheck

Description
BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or replace files on another user's unpublished draft pages.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-24
Last Modified
2026-10-24
Generated
2026-10-24
AI Q&A
2026-10-24
EPSS Evaluated
N/A
NVD
CVE-2026-116020
EUVD
EUVD-2026-109278

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
BookStackApp BookStack 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

BookStack before version 26.09.2 has an authorization flaw in the AttachmentController. Authenticated users with attachment permissions can access other users' draft page attachments by guessing sequential attachment IDs. This allows actions like downloading, renaming, relinking, or replacing files on unpublished draft pages.

Impact Analysis

If exploited, attackers could access sensitive files on your draft pages, modify or replace them, or leak confidential information. This could lead to data breaches, unauthorized changes, or reputational damage if the drafts contain proprietary or personal data.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data in drafts or HIPAA by leaking protected health information. Non-compliance may result in fines, legal penalties, or loss of certification if drafts contain regulated data.

Mitigation Strategies

Update BookStack to version 26.09.2 or later to address the incorrect authorization vulnerability in AttachmentController affecting draft pages.

Review user permissions to ensure only authorized users can access draft page attachments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116020. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart