{"id":"CVE-2026-126811","kind":"vulnerability","aliases":["CVE-2026-126811"],"related":[],"title":"BookStack: authenticated users can read and alter other users' draft images","description":"BookStack before 26.09.3 contains an incorrect authorization vulnerability that allows authenticated users to access other users' unpublished draft page images by checking only PageView permission without draft status. Attackers can read drawio data via the base64 endpoint or rename, replace, or delete draft images by sequential ID to disclose or tamper with unpublished work.","summary":"BookStack before 26.09.3 checks only page view permission when serving draft page images, so any logged-in user with view rights can read other users' unpublished draft drawings. An attacker can also rename, replace or delete those draft images by walking sequential IDs.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bookstack","package","php","self-hosted"],"not_affected_if":["auth-required","single-user"],"how_to_check":"- Check the BookStack version in the install, for example `composer.json` or the version shown in the admin settings page.\n- Confirm whether the instance has multiple users who can view pages, since the flaw needs an authenticated account.","fix":"- BookStack: move to `26.09.3` or later.","status":"open","published_at":"2026-11-11T21:16:45+00:00","first_seen_at":"2026-11-11T21:29:08+00:00","triaged_at":"2026-11-11T21:30:51+00:00","updated_at":"2026-11-11T21:30:51+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-11-11T21:30:51Z","model":"claude-haiku-5-5","output":{"fix":"- BookStack: move to `26.09.3` or later.","reach":"network","title":"BookStack: authenticated users can read and alter other users' draft images","impact":"medium","summary":"BookStack before 26.09.3 checks only page view permission when serving draft page images, so any logged-in user with view rights can read other users' unpublished draft drawings. An attacker can also rename, replace or delete those draft images by walking sequential IDs.","audience":"businesses","category":"package","nicknames":[],"who_cares":["bookstack","self-hosted","php"],"confidence":0.75,"fix_status":"available","needs_auth":"yes","worst_case":"other users' unpublished drafts read, renamed, replaced or deleted","analyst_note":"","how_to_check":"- Check the BookStack version in the install, for example `composer.json` or the version shown in the admin settings page.\n- Confirm whether the instance has multiple users who can view pages, since the flaw needs an authenticated account.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["single-user","auth-required"],"who_is_affected":"Self-hosted BookStack instances before 26.09.3 with more than one user account are exposed, because any logged-in user who can view pages can reach other users' drafts. Instances with a single user, or where every user already sees all content, have little to lose. unknown whether the sources name a non-default setting.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000725,"input_tokens":4617,"output_tokens":526,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126811':14A,17A '-2026':13A,16A '26.09.3':26B,70C 'access':81C 'allow':77C 'also':56B 'alter':7A 'attack':54B,96C 'authent':2A,78C 'author':74C 'base64':103C 'bookstack':1A,18B,24B,68C 'check':27B,89C 'contain':71C 'cve':12A,15A 'data':100C 'delet':60B,109C 'disclos':116C 'draft':10A,34B,51B,62B,85C,94C,110C 'draw':52B 'drawio':99C 'endpoint':104C 'host':23B 'id':67B,114C 'imag':11A,36B,63B,87C,111C 'incorrect':73C 'log':40B 'logged-in':39B 'packag':19B 'page':29B,35B,86C 'pageview':91C 'permiss':31B,92C 'php':20B 'read':5A,47B,98C 'renam':57B,106C 'replac':58B,107C 'right':45B 'self':22B 'self-host':21B 'sequenti':66B,113C 'serv':33B 'status':95C 'tamper':118C 'unpublish':50B,84C,120C 'user':3A,9A,42B,49B,79C,83C 'via':101C 'view':30B,44B 'vulner':75C 'walk':65B 'without':93C 'work':121C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted BookStack instances before 26.09.3 with more than one user account are exposed, because any logged-in user who can view pages can reach other users' drafts. Instances with a single user, or where every user already sees all content, have little to lose. unknown whether the sources name a non-default setting.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bookstack","medium","package","php","selfhosted"],"campaign_type":null,"search_a":"'-126811':14A,17A '-2026':13A,16A 'alter':7A 'authent':2A 'bookstack':1A 'cve':12A,15A 'draft':10A 'imag':11A 'read':5A 'user':3A,9A","search_b":"'26.09.3':26B 'also':56B 'attack':54B 'bookstack':18B,24B 'check':27B 'delet':60B 'draft':34B,51B,62B 'draw':52B 'host':23B 'id':67B 'imag':36B,63B 'log':40B 'logged-in':39B 'packag':19B 'page':29B,35B 'permiss':31B 'php':20B 'read':47B 'renam':57B 'replac':58B 'right':45B 'self':22B 'self-host':21B 'sequenti':66B 'serv':33B 'unpublish':50B 'user':42B,49B 'view':30B,44B 'walk':65B","search_c":"'26.09.3':70C 'access':81C 'allow':77C 'attack':96C 'authent':78C 'author':74C 'base64':103C 'bookstack':68C 'check':89C 'contain':71C 'data':100C 'delet':109C 'disclos':116C 'draft':85C,94C,110C 'drawio':99C 'endpoint':104C 'id':114C 'imag':87C,111C 'incorrect':73C 'page':86C 'pageview':91C 'permiss':92C 'read':98C 'renam':106C 'replac':107C 'sequenti':113C 'status':95C 'tamper':118C 'unpublish':84C,120C 'user':79C,83C 'via':101C 'vulner':75C 'without':93C 'work':121C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T21:16:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126811","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126811","severity":null,"published_at":"2026-11-11T21:16:45+00:00","modified_at":"2026-11-11T21:16:45+00:00","first_seen_at":"2026-11-11T21:29:08+00:00","fetched_at":"2026-11-11T21:29:08+00:00","note":null}],"documents":[{"id":128989,"url":"https://github.com/BookStackApp/BookStack/commit/926e16a23f346be47d44746d14cba40cb355cbe1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":128990,"url":"https://github.com/BookStackApp/BookStack/releases/tag/v26.09.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":128991,"url":"https://www.vulncheck.com/advisories/bookstack-before-26.09.3-incorrect-authorization-via-image-and-drawio-endpoints","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}