---
id: "CVE-2026-126811"
page: "https://infrastack.ai/live/CVE-2026-126811"
kind: "vulnerability"
aliases: ["CVE-2026-126811"]
title: "BookStack: authenticated users can read and alter other users' draft images"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bookstack", "package", "php", "self-hosted"]
not_affected_if: ["auth-required", "single-user"]
published_at: "2026-11-11T21:16:45+00:00"
first_seen_at: "2026-11-11T21:29:08+00:00"
updated_at: "2026-11-11T21:30:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126811", "first_seen_at": "2026-11-11T21:29:08+00:00"}]
exploit_sources: []
---

# BookStack: authenticated users can read and alter other users' draft images

Link for people: https://infrastack.ai/live/CVE-2026-126811 (this .md is for agents)

BookStack before 26.09.3 checks only page view permission when serving draft page images, so any logged-in user with view rights can read other users' unpublished draft drawings. An attacker can also rename, replace or delete those draft images by walking sequential IDs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the BookStack version in the install, for example `composer.json` or the version shown in the admin settings page.
- Confirm whether the instance has multiple users who can view pages, since the flaw needs an authenticated account.

## Fix

- BookStack: move to `26.09.3` or later.

## Timeline

- 2026-11-11T21:29:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126811

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/bookstack-before-26.09.3-incorrect-authorization-via-image-and-drawio-endpoints
- [fix] Patch: github.com https://github.com/BookStackApp/BookStack/commit/926e16a23f346be47d44746d14cba40cb355cbe1
- [fix] Release notes: github.com https://github.com/BookStackApp/BookStack/releases/tag/v26.09.3

## From the sources

BookStack before 26.09.3 contains an incorrect authorization vulnerability that allows authenticated users to access other users' unpublished draft page images by checking only PageView permission without draft status. Attackers can read drawio data via the base64 endpoint or rename, replace, or delete draft images by sequential ID to disclose or tamper with unpublished work.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_