Executive brief
BookStack is a popular self-hosted wiki and documentation platform used by teams to organize internal knowledge. A missing permission check in the attachment edit form endpoint allowed users with page update rights—but explicitly no page view rights—to retrieve sensitive attachment metadata and external URLs that should have been inaccessible. This could expose internal hostnames, tokens, or other sensitive information embedded in attachment links, depending on how the application is deployed and configured.
Technical details
The vulnerability is a broken access control flaw in the AttachmentController::getUpdateForm() method (app/Uploads/Controllers/AttachmentController.php). The method fetches attachments by numeric ID without first verifying the user can view the parent page, and renders attachment names and external link URLs in the form response without a PageView permission check—despite this check being present in every comparable method in the same controller. An attacker with PageUpdate and AttachmentCreate permissions but explicitly denied PageView can exploit this via a direct HTTP request to enumerate and extract attachment metadata. The attack requires a specific permission configuration (update-without-view role split) that the application explicitly supports. The fix, committed on 2026-07-24, adds the missing PageView check to align getUpdateForm() with other attachment-related methods.
Affected products
- BookStack BookStack up to 26.05.2
Timeline
- 2026-07-24: disclosed: Vulnerability details published in blog writeup
- 2026-07-24: patched: Fix shipped in commit 4e406c41c4c8060a5795e74c66fb96362e54f400
- 2026-09-07: advisory: CVE-2026-86285 published