Is CVE-2026-86285 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86285 being exploited in the wild.

How severe is CVE-2026-86285?

Medium severity, with a CVSS score of 4.3, published 7 September 2026.

Which products and versions are affected?

BookStack BookStack up to 26.05.2.

Is there a fix for CVE-2026-86285?

A patch was published on 2026-07-24: Fix shipped in commit 4e406c41c4c8060a5795e74c66fb96362e54f400 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86285 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86285?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86285: BookStack broken access control in attachment edit endpoint

CVE-2026-86285 · Severity: medium · CVSS 4.3 · Published 2026-09-07

BookStack is a popular self-hosted wiki and documentation platform used by teams to organize internal knowledge. A missing permission check in the attachment edit form endpoint allowed users with page update rights—but explicitly no page view rights—to retrieve sensitive attachment metadata and external URLs that should have been inaccessible. This could expose internal hostnames, tokens, or other sensitive information embedded in attachment links, depending on how the application is deployed and configured.

Quick answers

Is CVE-2026-86285 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86285 being exploited in the wild.
How severe is CVE-2026-86285?: Medium severity, with a CVSS score of 4.3, published 7 September 2026.
Which products and versions are affected?: BookStack BookStack up to 26.05.2.
Is there a fix for CVE-2026-86285?: A patch was published on 2026-07-24: Fix shipped in commit 4e406c41c4c8060a5795e74c66fb96362e54f400 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86285 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86285?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a broken access control flaw in the AttachmentController::getUpdateForm() method (app/Uploads/Controllers/AttachmentController.php). The method fetches attachments by numeric ID without first verifying the user can view the parent page, and renders attachment names and external link URLs in the form response without a PageView permission check—despite this check being present in every comparable method in the same controller. An attacker with PageUpdate and AttachmentCreate permissions but explicitly denied PageView can exploit this via a direct HTTP request to enumerate and extract attachment metadata. The attack requires a specific permission configuration (update-without-view role split) that the application explicitly supports. The fix, committed on 2026-07-24, adds the missing PageView check to align getUpdateForm() with other attachment-related methods.

Affected products

BookStack BookStack up to 26.05.2

Timeline

2026-07-24: disclosed: Vulnerability details published in blog writeup
2026-07-24: patched: Fix shipped in commit 4e406c41c4c8060a5795e74c66fb96362e54f400
2026-09-07: advisory: CVE-2026-86285 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.