CVE-2026-86285 BookStack CVE debrief

Who should care

Defenders responsible for BookStack installations should assess exposure and prioritize patching to prevent unauthorized access to attachments. This includes reviewing and updating access controls, monitoring for suspicious activity, and verifying patch deployment. Security teams should also review the vulnerability details and assess the potential impact on their organization.

Why it matters

CVE-2026-86285 allows remote attackers to exploit improper access controls in BookStack, potentially leading to unauthorized access to attachments. Defenders should prioritize patching and monitoring.

• Verify and patch BookStack installations to prevent exploitation
• Implement additional access controls for attachment editing
• Monitor for suspicious activity on attachment endpoints

Technical summary

The vulnerability affects the AttachmentController::getUpdateForm function in BookStack up to version 26.05.2. The issue allows for improper access controls due to a missing permission check, enabling remote attacks. A patch is available as 4e406c41c4c8060a5795e74c66fb96362e54f400. This vulnerability has been publicly disclosed and may be exploited. Defenders should prioritize patching BookStack installations to prevent unauthorized access to attachments. The vulnerability has a CVSS score of 2.1 and a severity of LOW.

Defensive priority

Defenders should prioritize patching BookStack installations to prevent unauthorized access to attachments.

Recommended defensive actions

• Patch BookStack installations to version 26.05.3 or later
• Implement additional access controls for attachment editing
• Monitor for suspicious activity on attachment endpoints
• Verify and patch BookStack installations to prevent exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was detected in BookStack up to version 26.05.2. The affected component is the Attachment Edit Endpoint. The exploit is public and may be used. The issue allows for improper access controls due to a missing permission check, enabling remote attacks. A patch is available as 4e406c41c4c8060a5795e74c66fb96362e54f400. Defenders should verify and patch BookStack installations to prevent exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.