CVE-2026-125870— BookStack before 26.09.3 Broken Access Control via ImageController

Quick assessment

Affected

bookstackapp bookstack

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 BookStack 26.09.3 之前的版本中，ImageController::checkImagePermission() 方法存在权限校验缺失漏洞。该漏洞允许已认证的非管理员用户绕过页面级别的内容限制，从而访问那些所属页面已被移至回收站（即已软删除）的图像资源。其根本原因在于权限检查依赖于 Page::getPage() 方法，而该方法对软删除页面返回 null，导致系统静默跳过 PageView 权限验证。攻击者可通过 GET /images/edit/{id} 接口枚举连续的图像 ID，进而泄露受

CVSS 4.2 · Medium Updated Nov 12, 2026

Possible ATT&CK Techniques 3 AI

T1083 · File and Directory Discovery T1070 · Indicator Removal T1548 · Abuse Elevation Control Mechanism

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

BookStack before 26.09.3 Broken Access Control via ImageController

Source: CVE Program / CVE List V5

Vulnerability Description

BookStack before 26.09.3 contains a missing authorization vulnerability in ImageController::checkImagePermission() that allows authenticated non-admin users to bypass page-level content restrictions for images whose owning page has been moved to the recycle bin, because the permission check relies on Page::getPage() which returns null for soft-deleted pages and silently skips the PageView check. Attackers can enumerate sequential image IDs via GET /images/edit/{id} to disclose metadata of restricted images, and users with image-update-all/image-delete-all privileges can rename, replace, or permanently delete images belonging to content they cannot view, persisting the damage even after the page is restored.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不正确

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
bookstackapp	bookstack	0 ~ 26.09.3	-

II. Public POCs for CVE-2026-125870

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-125870

请登录查看更多情报信息。

Other References for CVE-2026-125870 (4)

https://www.bookstackapp.com/blog/bookstack-release-v26-09-3/ vendor-advisory
https://github.com/BookStackApp/BookStack/releases/tag/v26.09.3 patch
https://codeberg.org/bookstack/bookstack/releases/tag/v26.09.3 patch
https://www.vulncheck.com/advisories/bookstack-before-broken-access-control-via-imagecontroller third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-125870

IV. Related Vulnerabilities

Same product: bookstack

Same vendor: bookstackapp

Same weakness: CWE-863