CVE-2026-116020

BookStack versions prior to 26.09.2 are vulnerable to an incorrect authorization flaw in the AttachmentController . This vulnerability allows authenticated users to access attachments belonging to other users' unpublished draft pages by identifying sequential attachment IDs. Attackers with suffic...