Medium
BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages
Type: advisorySource: Official CVE List
BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permiss…
Products: BookStackCVEs: CVE-2026-116020