Executive brief
BookStack is an open-source platform for organizing and storing documentation. A security flaw in the chapter export feature allowed users to view page content that they were not authorized to see. By exporting a chapter to Markdown format, an attacker could bypass visibility restrictions and access sensitive information within that chapter. This issue has been resolved in version 26.03.1.
Technical details
An improper access control vulnerability (CWE-284/CWE-266) exists in BookStack up to version 26.03 within the Chapter Export Handler. The 'chapterToMarkdown' function in 'app/Exports/ExportFormatter.php' incorrectly iterated over the raw '$chapter->pages' Eloquent relationship instead of using the permission-scoped 'getVisiblePages()' method. This allowed any authenticated user with export permissions to bypass page-level visibility restrictions and view the full content of all pages within a chapter. The vulnerability is exploitable remotely and a public proof-of-concept exists. The issue is fixed in version 26.03.1 by ensuring the export process respects visibility scopes.
Affected products
- BookStackApp BookStack up to 26.03
Timeline
- 2026-03-17: patched: Patch 8a59895ba063040cc8dafd82e94024c406df3d04 released in version 26.03.1
- 2026-04-03: disclosed: Initial vulnerability disclosure
- 2026-04-03: advisory
References
- https://github.com/BookStackApp/BookStack/
- https://github.com/BookStackApp/BookStack/commit/8a59895ba063040cc8dafd82e94024c406df3d04
- https://github.com/BookStackApp/BookStack/releases/tag/v26.03.1
- https://github.com/Ghufran2/CVE-Bookstack/blob/main/Permission%20Bypass%20in%20Markdown%20Chapter%20Export
- https://vuldb.com/submit/781762
- https://vuldb.com/vuln/355091
- https://vuldb.com/vuln/355091/cti