{"affected":[{"defaultStatus":"unaffected","ecosystem":"github","packageName":"bookstackapp/bookstack","product":"bookstack","source":"CNA: VulnCheck","vendor":"bookstackapp","versions":[{"lessThan":"26.09.3","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-125870","cwes":["CWE-863"],"description":"BookStack before 26.09.3 contains a missing authorization vulnerability in ImageController::checkImagePermission() that allows authenticated non-admin users to bypass page-level content restrictions for images whose owning page has been moved to the recycle bin, because the permission check relies on Page::getPage() which returns null for soft-deleted pages and silently skips the PageView check. Attackers can enumerate sequential image IDs via GET /images/edit/{id} to disclose metadata of restricted images, and users with image-update-all/image-delete-all privileges can rename, replace, or permanently delete images belonging to content they cannot view, persisting the damage even after the page is restored.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":2.3,"severity":"low","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":4.2,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1794487756026,"publishedAt":1794487685387,"references":[{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://codeberg.org/bookstack/bookstack/releases/tag/v26.09.3"},{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/BookStackApp/BookStack/releases/tag/v26.09.3"},{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://www.bookstackapp.com/blog/bookstack-release-v26-09-3/"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/bookstack-before-broken-access-control-via-imagecontroller"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://codeberg.org/bookstack/bookstack/releases/tag/v26.09.3"},{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/BookStackApp/BookStack/releases/tag/v26.09.3"}],"revision":"79532884168ad8bd25295ac11840ddff140e242abd963427a1a97a453d9a22cb","sources":[{"modifiedAt":1794487756026,"name":"CNA: VulnCheck","retrievedAt":1794488937458,"url":"https://www.cve.org/CVERecord?id=CVE-2026-125870"}],"ssvc":null,"status":"published","title":"BookStack before 26.09.3 Broken Access Control via ImageController","updatedAt":1794488937458}