CVE-2026-116020Published
BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-116020 · Microsoft / collected KEV context
cve-program · CVE-2026-116020
- https://codeberg.org/bookstack/bookstack/commit/fcadecccda706b4ecaf9ac3f8e27defe0ebe78ae
- https://www.bookstackapp.com/blog/bookstack-release-v26-09-2/
- https://codeberg.org/bookstack/bookstack/releases/tag/v26.09.2
- https://codeberg.org/bookstack/bookstack/src/tag/v26.09.1/app/Uploads/Controllers/AttachmentController.php
- https://www.vulncheck.com/advisories/bookstack-before-26.09.2-incorrect-authorization-via-attachmentcontroller-on-draft-pages
Related operational evidence
Explicit CVE identifiers- BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages · Newly collected advisory · 24 Oct 2026