CVE-2026-125870 · Package
NO FIX YET · SEE WHAT TO DO
BookStack skips the page-view permission check for images whose page is in the recycle bin. An authenticated non-admin user can read metadata of those images and, with image-update-all or image-delete-all rights, rename, replace or delete them.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted BookStack instances with multiple authenticated users who have restricted page access. Exposure requires a page to be moved to the recycle bin, and the image edit and delete risk requires the image-update-all or image-delete-all privileges. Single-user or fully trusted instances are less exposed.
Not affected if bookstack-26.09.3-or-later, single-user-instance
Who cares bookstack, self-hosted
26.09.3 or later.BookStack before 26.09.3 contains a missing authorization vulnerability in ImageController::checkImagePermission() that allows authenticated non-admin users to bypass page-level content restrictions for images whose owning page has been moved to the recycle bin, because the permission check relies on Page::getPage() which returns null for soft-deleted pages and silently skips the PageView check. Attackers can enumerate sequential image IDs via GET /images/edit/{id} to disclose metadata of restricted images, and users with image-update-all/image-delete-all privileges can rename, replace, or permanently delete images belonging to content they cannot view, persisting the damage even after the page is restored.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.