---
id: CVE-2026-116020
title: >-
  BookStack before 26.09.2 Incorrect Authorization via AttachmentController on
  Draft Pages
summary: >-
  BookStack before 26.09.2 contains an incorrect authorization vulnerability in
  AttachmentController that allows authenticated users to access other users'
  draft page attachments by ID. Attackers with attachment permissions can
  enumerate s…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: BookStackApp
product: BookStack
affected:
  - BookStack < 26.09.2
published: '2026-10-24'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T11:40:36.328Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116020'
references:
  - url: >-
      https://codeberg.org/bookstack/bookstack/commit/fcadecccda706b4ecaf9ac3f8e27defe0ebe78ae
  - url: 'https://www.bookstackapp.com/blog/bookstack-release-v26-09-2/'
  - url: 'https://codeberg.org/bookstack/bookstack/releases/tag/v26.09.2'
  - url: >-
      https://codeberg.org/bookstack/bookstack/src/tag/v26.09.1/app/Uploads/Controllers/AttachmentController.php
  - url: >-
      https://www.vulncheck.com/advisories/bookstack-before-26.09.2-incorrect-authorization-via-attachmentcontroller-on-draft-pages
    label: >-
      VulnCheck Advisory: BookStack before 26.09.2 Incorrect Authorization via
      AttachmentController on Draft Pages
tags:
  - cve.org
ingestedAt: '2026-10-24T11:57:47.026Z'
---

## Overview

BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or replace files on another user's unpublished draft pages.

## Affected

- `BookStack < 26.09.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.