CVE-2026-126811— BookStack before 26.09.3 Incorrect Authorization via Image and Drawio Endpoints

Quick assessment

Affected

BookStackApp BookStack

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 26.09.3 版本之前的 BookStack 存在一个授权错误漏洞。该漏洞允许已认证用户仅通过检查权限（而未验证草稿状态）来访问其他用户未发布的草稿页面图片。攻击者可通过 base64 端点读取 Draw.io 数据，或按顺序 ID 重命名、替换或删除草稿图片，从而泄露或篡改未发布的工作内容。

CVSS 5.4 · Medium Updated Nov 12, 2026

Possible ATT&CK Techniques 3 AI

T1083 · File and Directory Discovery T1565 · Data Manipulation T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

BookStack before 26.09.3 Incorrect Authorization via Image and Drawio Endpoints

Source: CVE Program / CVE List V5

Vulnerability Description

BookStack before 26.09.3 contains an incorrect authorization vulnerability that allows authenticated users to access other users' unpublished draft page images by checking only PageView permission without draft status. Attackers can read drawio data via the base64 endpoint or rename, replace, or delete draft images by sequential ID to disclose or tamper with unpublished work.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不正确

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
BookStackApp	BookStack	0 ~ 26.09.3	-

II. Public POCs for CVE-2026-126811

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-126811

请登录查看更多情报信息。

Other References for CVE-2026-126811 (10)

https://github.com/BookStackApp/BookStack/blob/v26.09.2/app/Uploads/Controllers/ImageController.php#L159-L169 technical-description
https://codeberg.org/bookstack/bookstack/releases/tag/v26.09.3 release-notes
https://github.com/BookStackApp/BookStack/blob/v26.09.2/app/Uploads/Controllers/DrawioImageController.php#L82-L92 technical-description
https://www.bookstackapp.com/blog/bookstack-release-v26-09-3/ release-notes
https://github.com/fishtankyu/bookstack-draft-image-idor-advisory.md third-party-advisory
https://codeberg.org/bookstack/bookstack/commit/926e16a23f346be47d44746d14cba40cb355cbe1 patch
https://github.com/BookStackApp/BookStack/commit/926e16a23f346be47d44746d14cba40cb355cbe1 patch
https://codeberg.org/bookstack/bookstack/commit/4fec06236cbfb314fd72c1b3614c7c50162fb41c patch
https://github.com/BookStackApp/BookStack/releases/tag/v26.09.3 release-notes
https://www.vulncheck.com/advisories/bookstack-before-26.09.3-incorrect-authorization-via-image-and-drawio-endpoints third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-126811

IV. Related Vulnerabilities

Same product: BookStack

Same vendor: BookStackApp

Same weakness: CWE-863