CVE-2026-126811 · Package
NO FIX YET · SEE WHAT TO DO
BookStack before 26.09.3 checks only page view permission when serving draft page images, so any logged-in user with view rights can read other users' unpublished draft drawings. An attacker can also rename, replace or delete those draft images by walking sequential IDs.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted BookStack instances before 26.09.3 with more than one user account are exposed, because any logged-in user who can view pages can reach other users' drafts. Instances with a single user, or where every user already sees all content, have little to lose. unknown whether the sources name a non-default setting.
Not affected if auth-required, single-user
Who cares bookstack, php, self-hosted
composer.json or the version shown in the admin settings page.26.09.3 or later.BookStack before 26.09.3 contains an incorrect authorization vulnerability that allows authenticated users to access other users' unpublished draft page images by checking only PageView permission without draft status. Attackers can read drawio data via the base64 endpoint or rename, replace, or delete draft images by sequential ID to disclose or tamper with unpublished work.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.