Description
A vulnerability was detected in BookStack up to 26.05.2. Affected by this issue is the function AttachmentController::getUpdateForm of the file app/Uploads/Controllers/AttachmentController.php of the component Attachment Edit Endpoint. The manipulation of the argument ID results in improper access controls. The attack may be launched remotely. The exploit is now public and may be used. The patch is identified as 4e406c41c4c8060a5795e74c66fb96362e54f400. It is advisable to implement a patch to correct this issue.
Published: 2026-09-07
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized access to attachment data potentially exposing confidential information
Action: Apply Patch
AI Analysis

Impact

The vulnerability exists in BookStack up to version 26.05.2 within the AttachmentController::getUpdateForm method. Manipulating the attachment ID bypasses the intended permission checks, meaning an attacker can retrieve or edit the update form for attachments they do not own, thereby leaking attachment data. This is a classic broken‑access‑control flaw as reflected by the listed CWEs.

Affected Systems

BookStack up to version 26.05.2 is affected. The patch containing commit 4e406c41c4c8060a5795e74c66fb96362e54f400 resolves the issue.

Risk and Exploitability

The vulnerability carries a CVSS score of 5.3, indicating moderate severity, and no EPSS score is currently available. It is not listed in the CISA KEV catalog, but the exploit is publicly known. The attack vector is remote, relying on manipulated identifiers, so any host running an affected BookStack instance is potentially at risk if an attacker can send crafted requests.

Generated by OpenCVE AI on September 7, 2026 at 13:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest patch or upgrade to BookStack 26.05.3 or newer that incorporates the commit 4e406c41c4c8060a5795e74c66fb96362e54f400.
  • Verify that the attachment update route now performs a proper permission check so only authorized users can access the form for a given attachment, using role‑based or ownership validations.
  • Until the patch is applied, restrict direct access to attachment update URLs by disabling or protecting these endpoints, ensuring the attachment ID is strictly validated and that unauthenticated users cannot retrieve them.

Generated by OpenCVE AI on September 7, 2026 at 13:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 09 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 07 Sep 2026 08:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in BookStack up to 26.05.2. Affected by this issue is the function AttachmentController::getUpdateForm of the file app/Uploads/Controllers/AttachmentController.php of the component Attachment Edit Endpoint. The manipulation of the argument ID results in improper access controls. The attack may be launched remotely. The exploit is now public and may be used. The patch is identified as 4e406c41c4c8060a5795e74c66fb96362e54f400. It is advisable to implement a patch to correct this issue.
Title BookStack Attachment Edit Endpoint AttachmentController.php getUpdateForm access control
First Time appeared Bookstack
Bookstack bookstack
Weaknesses CWE-266
CWE-284
CPEs cpe:2.3:a:bookstack:bookstack:*:*:*:*:*:*:*:*
Vendors & Products Bookstack
Bookstack bookstack
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Bookstack Bookstack
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-09T14:20:25.022Z

Reserved: 2026-09-06T14:24:39.026Z

Link: CVE-2026-86285

cve-icon Vulnrichment

Updated: 2026-09-09T14:20:16.655Z

cve-icon NVD

Status : Deferred

Published: 2026-09-07T09:17:17.127

Modified: 2026-09-09T15:17:16.283

Link: CVE-2026-86285

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T14:00:17Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-284

    Improper Access Control