PT-2026-145468

CVE-2026-126811

·

Published

2026-11-11

·

Updated

2026-11-11

Description by

CVSS 3.1
5.4
Medium
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
BookStack before 26.09.3 contains an incorrect authorization vulnerability that allows authenticated users to access other users' unpublished draft page images by checking only PageView permission without draft status. Attackers can read drawio data via the base64 endpoint or rename, replace, or delete draft images by sequential ID to disclose or tamper with unpublished work.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-863: Incorrect Authorization
Related identifiers
CVE-2026-126811
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com