CVE-2026-86285: BookStack Attachment Auth Bypass Vulnerability

CVE-2026-86285 is an authentication bypass vulnerability in BookStack up to version 26.05.2 affecting the attachment edit endpoint. Attackers can exploit improper access controls to gain unauthorized access. This article covers technical details, affected versions, security impact, and available patches.

CVE-2026-86285 Overview

CVE-2026-86285 is a broken access control vulnerability in BookStack versions up to 26.05.2. The flaw resides in the AttachmentController::getUpdateForm function within app/Uploads/Controllers/AttachmentController.php, which handles the Attachment Edit Endpoint. Manipulation of the ID argument bypasses permission checks and exposes attachment data to unauthorized authenticated users. The issue is classified under CWE-266: Incorrect Privilege Assignment. A public exploit exists, and the maintainers have released patch commit 4e406c41c4c8060a5795e74c66fb96362e54f400 to address the issue.

Critical Impact
Authenticated remote attackers can retrieve attachment data belonging to other users by tampering with the attachment ID parameter sent to the edit form endpoint.

Affected Products

BookStack versions up to and including 26.05.2
Component: Attachment Edit Endpoint (app/Uploads/Controllers/AttachmentController.php)
Function: AttachmentController::getUpdateForm

Discovery Timeline

2026-09-07 - CVE CVE-2026-86285 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86285

Vulnerability Analysis

BookStack is a self-hosted, open-source documentation and wiki platform written in PHP using the Laravel framework. Attachments in BookStack are files uploaded and linked to pages, and each attachment is scoped to a page whose read permissions determine who may access it.

The vulnerable code path is AttachmentController::getUpdateForm, which returns the HTML edit form for a given attachment ID. The endpoint accepts the attachment ID from the request but fails to verify that the requesting user has permission to view or modify that specific attachment. Any authenticated low-privilege user can iterate attachment IDs and receive form data containing metadata about attachments they should not be able to access.

The vulnerability is limited in scope to information exposure. It does not permit modification of the affected data or denial of service.

Root Cause

The root cause is a missing authorization check inside the update-form handler. The controller retrieves the attachment record based on the user-supplied ID without invoking BookStack's page-level permission validator before returning the form contents. This is a classic Insecure Direct Object Reference (IDOR) pattern aligned with CWE-266.

Attack Vector

Exploitation requires network access to the BookStack instance and a valid low-privilege user account. The attacker sends a crafted HTTP request to the attachment edit form endpoint with an incrementing or targeted ID value. The server returns the update form populated with attachment data even when the caller lacks permission to the parent page. No user interaction is required beyond the attacker's own request. See the technical write-up by Ashutosh Jena for a detailed walkthrough of the request flow.

Detection Methods for CVE-2026-86285

Indicators of Compromise

Web server access logs showing repeated requests to the attachment update form endpoint with sequential or enumerated ID values from a single authenticated session.
HTTP 200 responses to attachment edit form requests from user accounts that lack read access to the corresponding parent pages.
Unusual spikes in requests to /attachments/edit/{id} or equivalent routes handled by AttachmentController::getUpdateForm.

Detection Strategies

Correlate BookStack application logs with user role assignments to identify accounts that successfully retrieved attachment forms outside their permitted content scope.
Deploy web application firewall (WAF) rules to flag high-frequency, low-diversity requests targeting attachment edit endpoints.
Review database audit trails, if enabled, for attachment lookups that do not match the authenticated user's accessible page set.

Monitoring Recommendations

Enable verbose HTTP request logging on the BookStack reverse proxy and forward events to a centralized log analytics pipeline.
Alert on any single session issuing more than a defined threshold of attachment edit form requests within a short window.
Track BookStack version strings across managed instances to identify hosts running 26.05.2 or earlier that remain unpatched.

How to Mitigate CVE-2026-86285

Immediate Actions Required

Upgrade BookStack to a version that includes commit 4e406c41c4c8060a5795e74c66fb96362e54f400 from the official Codeberg repository.
Audit BookStack user accounts and remove inactive or unnecessary low-privilege users who could exploit the endpoint.
Review web server access logs for prior enumeration activity against attachment edit routes.

Patch Information

The BookStack maintainers have published a fix in commit 4e406c41c4c8060a5795e74c66fb96362e54f400, which introduces the missing permission check in AttachmentController::getUpdateForm. Administrators should apply the update by pulling the latest release from the BookStack project on Codeberg or upgrading through their standard package channel. Additional context is available in the VulDB advisory.

Workarounds

Restrict network access to the BookStack instance so that only trusted users can authenticate, reducing the attacker population.
Place a reverse proxy or WAF rule in front of the attachment edit endpoint to require additional validation until the patch is applied.
Temporarily disable or restrict attachment functionality for untrusted user roles where feasible.

bash

# Example: apply the upstream patch commit to an existing BookStack checkout
cd /var/www/bookstack
git fetch origin
git cherry-pick 4e406c41c4c8060a5795e74c66fb96362e54f400
php artisan cache:clear
php artisan config:clear