CVE-2026-125870

BookStack before 26.09.3 contains a missing authorization vulnerability in ImageController::checkImagePermission that allows authenticated non-admin users to bypass page-level content restrictions for images whose owning page has been moved to the recycle bin, because the permission check relies ...

CVE-2026-125870 BookStack before 26.09.3 Broken Access Control via ImageController

BookStack before 26.09.3 contains a missing authorization vulnerability in ImageController::checkImagePermission that allows authenticated non-admin users to bypass page-level content restrictions for images whose owning page has been moved to the recycle bin, because the permission check relies ...

EUVD-2026-124394

BookStack before 26.09.3 contains a missing authorization vulnerability in ImageController::checkImagePermission that allows authenticated non-admin users to bypass page-level content restrictions for images whose owning page has been moved to the recycle bin, because the permission check relies ...

CVE-2026-125870

BookStack versions before 26.09.3 are vulnerable to a missing authorization flaw in ImageController::checkImagePermission(). The vulnerability occurs because the permission check relies on Page::getPage(), which returns null for soft-deleted pages in the recycle bin, causing the system to silentl...