CVE-2026-126811mediumCWE-863

CVE-2026-126811: medium-severity vulnerability in BookStackApp BookStack

BookStack before 26.09.3 Incorrect Authorization via Image and Drawio Endpoints

Published

Follow this CVE+ Monitor BookStack

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

10Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3
BookStack before 26.09.3 contains an incorrect authorization vulnerability that allows authenticated users to access other users' unpublished draft page images by checking only PageView permission without draft status. Attackers can read drawio data via the base64 endpoint or rename, replace, or delete draft images by sequential ID to disclose or tamper with unpublished work.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
BookStackApp · BookStack
Related CVEs — BookStackApp BookStack

In the same product, most dangerous first.

CVE-2020-5256HIGHRemote Code Execution Through Image Uploads in BookStackEPSS 2.0%CVE-2020-26210HIGHCross-Site Scripting in BookStackEPSS 1.2%CVE-2020-26211HIGHCross-Site Scripting in BookStackEPSS 1.1%CVE-2020-26260MEDIUMServer Side Request Forgery in BookStackEPSS 0.8%CVE-2020-11055MEDIUMCross-site Scripting in BookStackEPSS 0.8%CVE-2026-67204MEDIUMBookStack < 26.05.4 Broken Access Control via Image Gallery APIEPSS 0.4%