334 matches found
CVE-2026-125870
BookStack before 26.09.3 contains a missing authorization vulnerability in ImageController::checkImagePermission that allows authenticated non-admin users to bypass page-level content restrictions for images whose owning page has been moved to the recycle bin, because the permission check relies ...
EUVD-2026-124394
BookStack before 26.09.3 contains a missing authorization vulnerability in ImageController::checkImagePermission that allows authenticated non-admin users to bypass page-level content restrictions for images whose owning page has been moved to the recycle bin, because the permission check relies ...
CVE-2026-125870 BookStack before 26.09.3 Broken Access Control via ImageController
BookStack before 26.09.3 contains a missing authorization vulnerability in ImageController::checkImagePermission that allows authenticated non-admin users to bypass page-level content restrictions for images whose owning page has been moved to the recycle bin, because the permission check relies ...
CVE-2026-125870
BookStack versions before 26.09.3 are vulnerable to a missing authorization flaw in ImageController::checkImagePermission(). The vulnerability occurs because the permission check relies on Page::getPage(), which returns null for soft-deleted pages in the recycle bin, causing the system to silentl...
CVE-2026-125870 BookStack before 26.09.3 Broken Access Control via ImageController
BookStack before 26.09.3 contains a missing authorization vulnerability in ImageController::checkImagePermission that allows authenticated non-admin users to bypass page-level content restrictions for images whose owning page has been moved to the recycle bin, because the permission check relies ...
CVE-2026-126811
BookStack before 26.09.3 contains an incorrect authorization vulnerability that allows authenticated users to access other users' unpublished draft page images by checking only PageView permission without draft status. Attackers can read drawio data via the base64 endpoint or rename, replace, or...
CVE-2026-126811
BookStack before 26.09.3 contains an incorrect authorization vulnerability that allows authenticated users to access other users' unpublished draft page images by checking only PageView permission without draft status. Attackers can read drawio data via the base64 endpoint or rename, replace, or...
CVE-2026-126811
BookStack versions prior to 26.09.3 are susceptible to an incorrect authorization vulnerability. The flaw exists because the application checks for PageView permissions but fails to verify the draft status of page images. This allows authenticated users to access other users' unpublished draft im...
CVE-2026-126811 BookStack before 26.09.3 Incorrect Authorization via Image and Drawio Endpoints
BookStack before 26.09.3 contains an incorrect authorization vulnerability that allows authenticated users to access other users' unpublished draft page images by checking only PageView permission without draft status. Attackers can read drawio data via the base64 endpoint or rename, replace, or...
CVE-2026-126811 BookStack before 26.09.3 Incorrect Authorization via Image and Drawio Endpoints
BookStack before 26.09.3 contains an incorrect authorization vulnerability that allows authenticated users to access other users' unpublished draft page images by checking only PageView permission without draft status. Attackers can read drawio data via the base64 endpoint or rename, replace, or...
EUVD-2026-124026
BookStack before 26.09.3 contains an incorrect authorization vulnerability that allows authenticated users to access other users' unpublished draft page images by checking only PageView permission without draft status. Attackers can read drawio data via the base64 endpoint or rename, replace, or...
PT-2026-145468
BookStack before 26.09.3 contains an incorrect authorization vulnerability that allows authenticated users to access other users' unpublished draft page images by checking only PageView permission without draft status. Attackers can read drawio data via the base64 endpoint or rename, replace, or...
CVE-2026-126811: BookStackApp BookStack: BookStack before 26.09.3 contains an incorrect authorization vulnerability that allows authenticated users to access…
BookStack before 26.09.3 contains an incorrect authorization vulnerability that allows authenticated users to access other users' unpublished draft page images by checking only PageView permission without draft status. Attackers can read drawio data via the base64 endpoint or rename, replace, or...
CVE-2026-116020
BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or...
CVE-2026-116020
BookStack versions prior to 26.09.2 are vulnerable to an incorrect authorization flaw in the AttachmentController . This vulnerability allows authenticated users to access attachments belonging to other users' unpublished draft pages by identifying sequential attachment IDs. Attackers with suffic...
EUVD-2026-109278
BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or...
CVE-2026-116020 BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages
BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or...
PT-2026-122601
BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or...
CVE-2026-89022
BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows unauthenticated attackers to sign in as arbitrary users by authenticating through a different social provider sharing the same driverid namespace. Attackers can authenticate at...
CVE-2026-89022 BookStack < 26.05.5 Authentication Bypass via Social Login Provider Confusion
BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows unauthenticated attackers to sign in as arbitrary users by authenticating through a different social provider sharing the same driverid namespace. Attackers can authenticate at...