CVE-2026-126811mediumCWE-863

CVE-2026-126811: fallo de gravedad media en BookStackApp BookStack

BookStack before 26.09.3 Incorrect Authorization via Image and Drawio Endpoints

Publicada el

Seguir esta CVE+ Monitorear BookStack

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

10Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3
BookStack before 26.09.3 contains an incorrect authorization vulnerability that allows authenticated users to access other users' unpublished draft page images by checking only PageView permission without draft status. Attackers can read drawio data via the base64 endpoint or rename, replace, or delete draft images by sequential ID to disclose or tamper with unpublished work.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
BookStackApp · BookStack
CVEs relacionadas — BookStackApp BookStack

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-5256HIGHRemote Code Execution Through Image Uploads in BookStackEPSS 2.0%CVE-2020-26210HIGHCross-Site Scripting in BookStackEPSS 1.2%CVE-2020-26211HIGHCross-Site Scripting in BookStackEPSS 1.1%CVE-2020-26260MEDIUMServer Side Request Forgery in BookStackEPSS 0.8%CVE-2020-11055MEDIUMCross-site Scripting in BookStackEPSS 0.8%CVE-2026-67204MEDIUMBookStack < 26.05.4 Broken Access Control via Image Gallery APIEPSS 0.4%