# CVE-2026-5484: BookStack improper access control in Chapter Export Handler

Source: https://junglewise.ai/threats/cve-2026-5484-bookstack-improper-access-control-in-chapter-export-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-03. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-5484 · Severity: medium · CVSS 5.3 · Published 2026-04-03

BookStack is an open-source platform for organizing and storing documentation. A security flaw in the chapter export feature allowed users to view page content that they were not authorized to see. By exporting a chapter to Markdown format, an attacker could bypass visibility restrictions and access sensitive information within that chapter. This issue has been resolved in version 26.03.1.

Technologies: [BookStackApp BookStack](https://junglewise.ai/threats/technologies/bookstack). Vendors: [BookStackApp](https://junglewise.ai/threats/vendors/bookstackapp).

## Quick answers

**Is CVE-2026-5484 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5484 being exploited in the wild.

**How severe is CVE-2026-5484?** Medium severity, with a CVSS score of 5.3, published 3 April 2026.

**Which products and versions are affected?** BookStackApp BookStack up to 26.03.

**Is there a fix for CVE-2026-5484?** A patch was published on 2026-03-17: Patch 8a59895ba063040cc8dafd82e94024c406df3d04 released in version 26.03.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-5484 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-5484?** Check whether you run BookStackApp BookStack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper access control vulnerability (CWE-284/CWE-266) exists in BookStack up to version 26.03 within the Chapter Export Handler. The 'chapterToMarkdown' function in 'app/Exports/ExportFormatter.php' incorrectly iterated over the raw '$chapter->pages' Eloquent relationship instead of using the permission-scoped 'getVisiblePages()' method. This allowed any authenticated user with export permissions to bypass page-level visibility restrictions and view the full content of all pages within a chapter. The vulnerability is exploitable remotely and a public proof-of-concept exists. The issue is fixed in version 26.03.1 by ensuring the export process respects visibility scopes.

## Affected products

- BookStackApp BookStack up to 26.03

## Timeline

- 2026-03-17: patched: Patch 8a59895ba063040cc8dafd82e94024c406df3d04 released in version 26.03.1
- 2026-04-03: disclosed: Initial vulnerability disclosure
- 2026-04-03: advisory

## References

- [https://github.com/BookStackApp/BookStack/](https://github.com/BookStackApp/BookStack/)
- [https://github.com/BookStackApp/BookStack/commit/8a59895ba063040cc8dafd82e94024c406df3d04](https://github.com/BookStackApp/BookStack/commit/8a59895ba063040cc8dafd82e94024c406df3d04)
- [https://github.com/BookStackApp/BookStack/releases/tag/v26.03.1](https://github.com/BookStackApp/BookStack/releases/tag/v26.03.1)
- [https://github.com/Ghufran2/CVE-Bookstack/blob/main/Permission%20Bypass%20in%20Markdown%20Chapter%20Export](https://github.com/Ghufran2/CVE-Bookstack/blob/main/Permission%20Bypass%20in%20Markdown%20Chapter%20Export)
- [https://vuldb.com/submit/781762](https://vuldb.com/submit/781762)
- [https://vuldb.com/vuln/355091](https://vuldb.com/vuln/355091)
- [https://vuldb.com/vuln/355091/cti](https://vuldb.com/vuln/355091/cti)