BookStack prior to version 26.09.2 contains an incorrect authorization flaw within the AttachmentController that permits any authenticated user with attachment permissions to access, download, rename, relink, or replace files attached to other users’ draft pages. This permits the attacker to exfiltrate content from unpublished drafts, alter the attachments within those drafts, or substitute their own files, thereby compromising both the confidentiality and integrity of draft content. The flaw is an example of a mistaken access control check, identified as CWE-863.

All instances of BookStack running a version earlier than 26.09.2, including 26.09.1 and any preceding releases, are affected.

The CVSS score of 5.3 classifies the exploit as a moderate severity issue. Because the vulnerability can only be leveraged by authenticated users who have permission to manage attachments, the attack vector requires valid credentials and appropriate access rights. No public exploits are currently known, the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the ability to enumerate attachment IDs and perform destructive operations on unpublished drafts makes this a significant risk for organizations with sensitive draft content or limited user base.