CVE-2026-86285
Received Received - Intake

Improper Access Control in BookStack Attachment Edit Endpoint

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulDB

Description
A vulnerability was detected in BookStack up to 26.05.2. Affected by this issue is the function AttachmentController::getUpdateForm of the file app/Uploads/Controllers/AttachmentController.php of the component Attachment Edit Endpoint. The manipulation of the argument ID results in improper access controls. The attack may be launched remotely. The exploit is now public and may be used. The patch is identified as 4e406c41c4c8060a5795e74c66fb96362e54f400. It is advisable to implement a patch to correct this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86285
EUVD
EUVD-2026-72301

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bookstack bookstack to 26.05.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a broken access control issue in BookStack up to version 26.05.2. It affects the Attachment Edit Endpoint where the function AttachmentController::getUpdateForm does not properly check permissions when accessing attachment data. The vulnerability allows users with page update rights but no page view rights to retrieve sensitive attachment information, such as names and external URLs.

Detection Guidance

Check BookStack application logs for unauthorized access attempts to the Attachment Edit Endpoint. Look for requests to app/Uploads/Controllers/AttachmentController.php with manipulated ID arguments. Review user permissions to verify if users without page view rights can access attachment data.

Impact Analysis

This vulnerability could allow unauthorized users to access sensitive attachment data, including internal hostnames, tokens, or URLs embedded in attachments. It may also enable enumeration of attachment IDs due to their sequential nature. The impact depends on the data stored in attachments and the permissions of the attacker.

Compliance Impact

This vulnerability involves improper access controls allowing users with page update rights but no page view rights to access attachment data. This could lead to unauthorized exposure of sensitive information such as attachment names, external URLs, internal hostnames, or tokens. Such data exposure may violate GDPR's principles of data protection and user privacy, as well as HIPAA's requirements for safeguarding protected health information if such data is involved.

Mitigation Strategies

Apply the patch identified as 4e406c41c4c8060a5795e74c66fb96362e54f400 immediately. Ensure the PageView permission check is enforced in the AttachmentController::getUpdateForm function to prevent unauthorized access to attachment data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86285. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart