Description

A vulnerability was detected in BookStack up to 26.05.2. Affected by this issue is the function AttachmentController::getUpdateForm of the file app/Uploads/Controllers/AttachmentController.php of the component Attachment Edit Endpoint. The manipulation of the argument ID results in improper access controls. The attack may be launched remotely. The exploit is now public and may be used. The patch is identified as 4e406c41c4c8060a5795e74c66fb96362e54f400. It is advisable to implement a patch to correct this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-07T09:17:17.127Z",
  "pubdate": "2026-09-07T09:17:17.127Z",
  "executiveSummary": "A critical improper access control vulnerability exists in BookStack versions up to and including 26.05.2.\nThe flaw resides within the AttachmentController::getUpdateForm function of the Attachment Edit Endpoint.\nThis vulnerability allows a remote attacker to bypass authorization mechanisms by manipulating the ID argument.\nSuccessful exploitation may lead to unauthorized access to attachment data or modification forms that should otherwise be restricted based on user permissions.\nGiven that exploit details are public, the risk of exploitation is high.\nThe vulnerability necessitates an immediate update to the identified secure version or application of the referenced patch to prevent unauthorized system interaction.",
  "technicalDetails": "The vulnerability is classified as an improper access control issue located in the app/Uploads/Controllers/AttachmentController.php file.\nThe root cause is a failure in the application's authorization logic within the AttachmentController::getUpdateForm function, which fails to correctly validate user permissions against the provided attachment ID.\nThe attack vector is remote, allowing an unauthenticated or low-privileged attacker to perform unauthorized operations by interacting with the Attachment Edit Endpoint.\nThe exploitation process follows a predictable pattern: an attacker identifies an attachment ID associated with restricted content. By crafting a specific HTTP request targeting the getUpdateForm method and supplying the target ID via the manipulated argument, the attacker circumvents the intended security boundary.\nBecause the controller does not verify if the current user session possesses the appropriate authorization level to access or modify the specified attachment resource, the application erroneously renders the update form or processes the request as if the user had legitimate authority.\nThis behavior exposes sensitive metadata or structural information about the attachment and potentially facilitates further unauthorized actions, such as improper modifications or unauthorized data disclosure.\nThe flaw affects all BookStack versions up to 26.05.2. Post-exploitation, an attacker could potentially gain insight into protected files or perform unauthorized edits, leading to a compromise of the integrity and confidentiality of the platform's attachment management system.\nThe vulnerability is fixed in patch 4e406c41c4c8060a5795e74c66fb96362e54f400, which presumably implements robust server-side ownership or permission verification before the controller processes the attachment identifier.\nThe lack of strict validation at the controller level effectively permits ID-based object access bypass, a common architectural weakness in web applications where resource identifiers are predictable and authorization logic is missing or improperly bound to the requested resource."
}