{"id":"CMP-202611-xqu744","kind":"campaign","aliases":[],"related":[],"title":"GitBook breached: attackers got into parts of GitBook's infrastructure on 2 Nov; docs sites and editor taken offline, customer data impact unknown","description":null,"summary":"GitBook (hosted documentation platform) says on its status page that on 2 Nov 2026 it detected unauthorized access to parts of its infrastructure, contained it and took services offline. Published docs sites and the editor went down from about 05:16 UTC on 3 Nov; they were mostly back by 12:32 UTC, with some published sites still degraded. GitBook has not yet said whether customer data was affected, and how the attackers got in is unknown. Separately, on the morning of 2 Nov, Trade.xyz reported unauthorized changes to its GitBook-hosted documentation. It restored the docs by 14:15 UTC and told users not to click links in them. Neither company has said the two events are connected.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-03T17:18:08+00:00","products":[{"name":"GitBook","fixed":[],"vendor":"GitBook"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Do you publish docs on GitBook (gitbook.io or a custom domain)? Look at the page history and recent changes in your spaces since 1 Nov 2026 for edits nobody on your team made, especially changed or added links, download URLs, install commands or wallet/contract addresses. Review GitBook audit logs for unknown members, API tokens or integrations, and check Git Sync repos for unexpected commits from GitBook. Specific indicators: unknown.","fix":"Review published GitBook content and roll back any unauthorized edits. Rotate GitBook API tokens and any Git Sync or integration credentials, and remove members or integrations you don't recognize. Watch GitBook's status page and wait for its post-incident report before trusting that your content is clean. If your docs could have been tampered with, warn your users not to follow links or run install commands from them until you've checked.","status":"open","published_at":null,"first_seen_at":"2026-11-03T17:18:08+00:00","triaged_at":"2026-11-03T17:18:08+00:00","updated_at":"2026-11-03T18:57:29+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':25A '05':71B '12':82B '14':131B '15':132B '16':72B '2':12A,43B,114B '2026':45B '3':75B '32':83B 'access':49B 'affect':100B 'attack':3A,104B 'back':80B 'breach':2A 'campaign':28B 'chang':119B 'click':139B 'cmp':24A 'compani':144B 'connect':151B 'contain':55B 'custom':20A,97B 'data':21A,98B 'degrad':90B 'detect':47B 'doc':14A,62B,129B 'document':34B,125B 'earli':30B 'early-warn':29B 'editor':17A,66B 'event':149B 'gitbook':1A,8A,27A,32B,91B,123B 'gitbook-host':122B 'got':4A,105B 'host':33B,124B 'impact':22A 'infrastructur':10A,54B 'link':140B 'morn':112B 'most':79B 'neither':143B 'nov':13A,44B,76B,115B 'offlin':19A,60B 'page':40B 'part':6A,51B 'platform':35B 'publish':61B,87B 'report':117B 'restor':127B 'said':95B,146B 'say':36B 'separ':109B 'servic':59B 'site':15A,63B,88B 'status':39B 'still':89B 'taken':18A 'told':135B 'took':58B 'trade.xyz':116B 'two':148B 'unauthor':48B,118B 'unknown':23A,108B 'user':136B 'utc':73B,84B,133B 'warn':31B 'went':67B 'whether':96B 'xqu744':26A 'yet':94B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["gitbook"],"ptokens":["gitbook"],"labels":["campaign","earlywarning","high","vendor"],"campaign_type":"breach","first_public_at":"2026-11-02T17:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-xqu744","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-03T17:18:08+00:00","fetched_at":"2026-11-03T17:18:08+00:00","note":null}],"documents":[{"id":58935,"url":"https://news.ycombinator.com/item?id=50354336","title":"Gitbook Breached","kind":"post","source":"hackernews","publisher":null,"text":"Gitbook Breached\n\n\n1 points, 0 comments on Hacker News","published_at":"2026-11-03T16:45:49+00:00","relation":"describes","confidence":null,"note":null},{"id":59114,"url":"https://isdown.app/status/gitbook/incidents/680445-downtime-affecting-published-sites-and-the-editor","title":"GitBook status: Downtime affecting published sites and the editor (unauthorized access detected Nov 2)","kind":"advisory","source":"analyst","publisher":null,"text":"GitBook status page, 2026-11-03 12:15 UTC: On November 2 we detected unauthorized access to parts of GitBook's infrastructure. We contained it quickly and took some services offline as a precaution. Investigation in progress; will confirm whether any customer data was affected. You don't need to do anything right now. Downtime of published docs sites and editor began 05:16 UTC Nov 3; app and public content back online 12:32 UTC; some published-site issues still at 14:58 UTC.","published_at":"2026-11-03T12:15:00+00:00","relation":"describes","confidence":null,"note":null},{"id":59115,"url":"https://crypto.news/trade-xyz-gitbook-docs-unauthorized-activity/","title":"Trade.xyz restores GitBook docs, warns users against links","kind":"other","source":"analyst","publisher":null,"text":"Trade.xyz identified unauthorized activity affecting its GitBook documentation on the morning of Nov 2, 2026; restored previous version by 9:15 a.m. ET (14:15 UTC); advises users not to click links within the documentation while investigation continues. Says user funds, trading platform and on-chain settlement not affected. Did not describe what changed or how access was gained.","published_at":"2026-11-02T17:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}