A weakness has been identified in BookStackApp BookStack, located in the function chapterToMarkdown of the Chapter Export Handler. The flaw allows manipulation of the pages argument, resulting in improper access controls. An attacker can exploit this vulnerability by remotely triggering the export process to gain unauthorized access to chapter data.

Affected systems include all installations of BookStackApp BookStack up to and including version 26.03. The vulnerability is present in the ExportFormatter.php component. Users running earlier releases have no known mitigation; upgrading to 26.03.1 or later resolves the issue.

The CVSS score of 6.9 indicates a moderate severity. EPSS data is unavailable, but the public exploit demonstrates that the vulnerability can be used remotely. It is not currently listed in the CISA KEV catalog. As the attack vector is remote and requires only manipulating a public‑facing endpoint, the risk to systems that expose the export functionality is significant for organizations that host uncensored or private content.