| Titel | BookStack 26.05.2 Missing authorization / Broken Access Control |
|---|
| Beschreibung | Summary
BookStack contains a missing authorization vulnerability in the attachment edit form endpoint (GET /attachments/edit/{id}) implemented by app/Uploads/Controllers/AttachmentController::getUpdateForm().
Affected Component
app/Uploads/Controllers/AttachmentController.php
Method: getUpdateForm()
Endpoint: GET /attachments/edit/{id}
Vulnerability
The endpoint loaded an attachment by its numeric ID and rendered the edit form without verifying the PageView permission on the parent page.
An authenticated user granted page update permissions, but explicitly denied page view permission through BookStack's permission model, could access the attachment edit form.
This allowed disclosure of attachment metadata including the attachment name and, for link-type attachments, the stored external URL despite the user being unable to access the parent page.
The issue is caused by a missing authorization check (Permission::PageView) before returning the edit form.
Impact
Information Disclosure.
Exposure of attachment names.
Exposure of stored external attachment URLs, which may contain internal hostnames, document references or authentication tokens.
No unauthorized modification was possible because the update endpoint correctly enforced the required permissions.
Fix
Fixed in commit:
https://codeberg.org/bookstack/bookstack/commit/4e406c41c4c8060a5795e74c66fb96362e54f400
The fix adds a Permission::PageView authorization check before rendering the attachment edit form and introduces a regression test (test_attachment_edit_form_access_requires_view_permission) to prevent recurrence. |
|---|
| Quelle | ⚠️ https://ashutosh-jena.in/blog/broken-access-control-in-bookstack-how-a-missing-permission-check-leaked-attachment-data |
|---|
| Benutzer | MAVERICK-VF142 (UID 99541) |
|---|
| Einreichung | 26.07.2026 06:48 (vor 1 Monat) |
|---|
| Moderieren | 06.09.2026 16:24 (1 month later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 399445 [BookStack bis 26.05.2 Attachment Edit Endpoint AttachmentController.php getUpdateForm ID erweiterte Rechte] |
|---|
| Punkte | 20 |
|---|