BookStack CVE-2026-116020

Exploitation requires an authenticated BookStack account that has been granted attachment permissions (PR:L) - it is not reachable by anonymous or unauthenticated users. The specific prerequisite is the presence of other users' unpublished draft pages that have attachments, and the enabling weakness is that the AttachmentController does not verify draft-page ownership while attachment IDs are assigned sequentially, making them guessable/enumerable. No user interaction by the victim is needed (UI:N) and the attack works against default configurations of affected versions (before 26.09.2). The main limiting factors are the authenticated-with-attachment-permission requirement and the bounded scope (only draft page attachments, not published content or the wider system), which keep real-world risk moderate despite the network vector.

This is a genuine but moderate-priority authorization flaw (CWE-863), not a critical emergency. The CVSS 4.0 base score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N) reflects the key constraint: PR:L means an attacker must already hold a valid, authenticated account with attachment permissions - this is a privilege-boundary bypass between authenticated users, not an unauthenticated internet-facing break. The vuln.today decision label is 'this_month' (routine-but-prompt patching), consistent with the moderate score. No EPSS score, no CISA KEV listing, and no confirmed public exploit code were provided, so there is no signal of active or widespread exploitation; exploitation status is best characterized as no public exploit identified at time of analysis. The practical risk driver is that attachment IDs are sequential and enumerable, so a single low-privilege account can trivially iterate IDs to reach other users' unpublished draft content - a low-complexity, automatable technique once access exists. Impact is bounded (VC:L/VI:L, VA:N): partial confidentiality and integrity loss over draft attachments only, no availability impact and no system-wide compromise. Net: a real multi-tenant data-exposure and tampering issue worth patching in a normal cycle, but it is not a high-urgency, remotely-wormable threat, and the missing EPSS/KEV data does not conflict with the modest CVSS - all available signals point the same moderate direction.

An authenticated BookStack user who holds attachment permissions scripts a loop over sequential attachment IDs belonging to other users' unpublished draft pages, then downloads confidential draft files or silently renames, relinks, or replaces them to corrupt or poison another author's work. Because attack complexity is low (AC:L) and no user interaction is required (UI:N), the enumeration can be fully automated once a foothold account exists. No confirmed public exploit code was provided; a VulnCheck advisory describes the issue but is not verified as working exploit code.