Live › vulnerability › CVE-2026-116020
Go to dashboardBookStack versions before 26.09.2 let any logged-in user reach attachments on other users' unpublished draft pages by guessing sequential attachment IDs. An attacker can download, rename, relink or replace those files.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 12:47 UTC. All times on this page are UTC.
Self-hosted or managed BookStack instances before 26.09.2 that have multiple user accounts who write draft pages with attachments. Single-user or read-only instances, and instances where only trusted editors can log in, are at lower risk.
No product ranges from the sources yet.
composer.lock / release tag; versions below 26.09.2 are affected.26.09.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or replace files on another user's unpublished draft pages.
This page as .md · .json · in your agent: get_signal("CVE-2026-116020")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.