Submit #905693: BookStack 26.05.2 Missing authorization / Broken Access Control

Summary

BookStack contains a missing authorization vulnerability in the attachment edit form endpoint (GET /attachments/edit/{id}) implemented by app/Uploads/Controllers/AttachmentController::getUpdateForm().

Affected Component

app/Uploads/Controllers/AttachmentController.php
Method: getUpdateForm()
Endpoint: GET /attachments/edit/{id}

Vulnerability

The endpoint loaded an attachment by its numeric ID and rendered the edit form without verifying the PageView permission on the parent page.
An authenticated user granted page update permissions, but explicitly denied page view permission through BookStack's permission model, could access the attachment edit form.
This allowed disclosure of attachment metadata including the attachment name and, for link-type attachments, the stored external URL despite the user being unable to access the parent page.
The issue is caused by a missing authorization check (Permission::PageView) before returning the edit form.

Impact

Information Disclosure.
Exposure of attachment names.
Exposure of stored external attachment URLs, which may contain internal hostnames, document references or authentication tokens.
No unauthorized modification was possible because the update endpoint correctly enforced the required permissions.

Fix

Fixed in commit:
https://codeberg.org/bookstack/bookstack/commit/4e406c41c4c8060a5795e74c66fb96362e54f400
The fix adds a Permission::PageView authorization check before rendering the attachment edit form and introduces a regression test (test_attachment_edit_form_access_requires_view_permission) to prevent recurrence.

• Source: ⚠️ https://ashutosh-jena.in/blog/broken-access-control-in-bookstack-how-a-missing-permission-check-leaked-attachment-data
• User: MAVERICK-VF142 (UID 99541)
• Submission: 07/26/2026 06:48 (1 month ago)
• Moderation: 09/06/2026 16:24 (1 month later)
• Status: Accepted
• VulDB entry: 399445 [BookStack up to 26.05.2 Attachment Edit Endpoint AttachmentController.php getUpdateForm ID access control]
• Points: 20