Medium severity · published Sep 7, 2026
CVE-2026-86285
BookStack Attachment Edit Endpoint AttachmentController.php getUpdateForm access control
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was detected in BookStack up to 26.05.2. Affected by this issue is the function AttachmentController::getUpdateForm of the file app/Uploads/Controllers/AttachmentController.php of the component Attachment Edit Endpoint. The manipulation of the argument ID results in improper access controls. The attack may be launched remotely. The exploit is now public and may be used. The patch is identified as 4e406c41c4c8060a5795e74c66fb96362e54f400. It is advisable to implement a patch to correct this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BO
BookStack · Bookstack
26.05.0; 26.05.1; 26.05.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86285
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86285
ashutosh-jena.in
https://ashutosh-jena.in/blog/broken-access-control-in-bookstack-how-a-missing-permission-check-leaked-attachment-data
codeberg.org
https://codeberg.org/bookstack/bookstack/commit/4e406c41c4c8060a5795e74c66fb96362e54f400
vuldb.com
https://vuldb.com/cve/CVE-2026-86285
vuldb.com
https://vuldb.com/submit/905693
vuldb.com
https://vuldb.com/vuln/399445
vuldb.com
https://vuldb.com/vuln/399445/cti
More from BookStack
5.4
CVE-2022-40690
Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to inject an arbitrary script