CVE-2026-126811mediumCWE-863

CVE-2026-126811: falha de média gravidade em BookStackApp BookStack

BookStack before 26.09.3 Incorrect Authorization via Image and Drawio Endpoints

Publicada em

Seguir esta CVE+ Monitorar BookStack

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

10Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3
BookStack before 26.09.3 contains an incorrect authorization vulnerability that allows authenticated users to access other users' unpublished draft page images by checking only PageView permission without draft status. Attackers can read drawio data via the base64 endpoint or rename, replace, or delete draft images by sequential ID to disclose or tamper with unpublished work.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
BookStackApp · BookStack
CVEs relacionadas — BookStackApp BookStack

No mesmo produto, das mais perigosas para as menos.

CVE-2020-5256HIGHRemote Code Execution Through Image Uploads in BookStackEPSS 2.0%CVE-2020-26210HIGHCross-Site Scripting in BookStackEPSS 1.2%CVE-2020-26211HIGHCross-Site Scripting in BookStackEPSS 1.1%CVE-2020-26260MEDIUMServer Side Request Forgery in BookStackEPSS 0.8%CVE-2020-11055MEDIUMCross-site Scripting in BookStackEPSS 0.8%CVE-2026-67204MEDIUMBookStack < 26.05.4 Broken Access Control via Image Gallery APIEPSS 0.4%