MEDIUMCVSS v3.1 5.4Vulnerability
CVE-2026-126811
BookStack before 26.09.3 contains an incorrect authorization vulnerability that allows authenticated users to access other users' unpublished draft page images by checking only PageView permission without draft status. Attackers can read drawio data via the base64 endpoint or rename, replace, or delete draft images by sequential ID to disclose or tamper with unpublished work.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-11T23:49:45.533241+00:00
- Cvss score
- 5.4
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-11-11T23:50:18+00:00
- Score
- 5.4
- Last source
- NVD
- Cvss version
- 3.1
- Cve id
- CVE-2026-126811
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- First seen by Signal
- 2026-11-11T23:46:41+00:00
- Name
- CVE-2026-126811
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Published at
- 2026-11-11T21:16:45.507
- Last modified
- 2026-11-11T21:16:45.507
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph