CVE-2026-5484 Details
Description
A weakness has been identified in BookStackApp BookStack up to 26.03. Affected is the function chapterToMarkdown of the file app/Exports/ExportFormatter.php of the component Chapter Export Handler. Executing a manipulation of the argument pages can lead to improper access controls. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 26.03.1 is able to address this issue. This patch is called 8a59895ba063040cc8dafd82e94024c406df3d04. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
A vulnerability exists in BookStackApp BookStack versions prior to 26.03. Chapter export functionality in the ExportFormatter component fails to properly enforce access controls, allowing unauthorized content to be exported. This issue arises because the chapterToMarkdown method uses a raw Eloquent relationship that includes all pages, bypassing permission filters. As a result, pages that should be hidden due to permissions can be accessed during markdown exports. The vulnerability can be exploited remotely by authenticated users with the content-export permission.
Users are advised to upgrade to BookStack version 26.03.1, which addresses this vulnerability by restoring proper permission handling in the chapter export feature.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 3, 2026CISA-ADP
Assessed Apr 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/BookStackApp/BookStack/ | [email protected] | ProductSource CodeVendor |
| https://github.com/BookStackApp/BookStack/commit/8a59895ba063040cc8dafd82e94024c406df3d04 | [email protected] | Source CodeVendor |
| https://github.com/BookStackApp/BookStack/releases/tag/v26.03.1 | [email protected] | Release NotesVendor |
| https://github.com/Ghufran2/CVE-Bookstack/blob/main/Permission%20Bypass%20in%20Markdown%20Chapter%20Export | [email protected] | ExploitTechnical Analysis |
| https://vuldb.com/submit/781762 | [email protected] | Issue TrackingTechnical Description |
| https://vuldb.com/vuln/355091 | [email protected] | AdvisoryExploitRemedy |
| https://vuldb.com/vuln/355091/cti | [email protected] | Content Wall |
| https://www.bookstackapp.com/blog/bookstack-release-v26-03-1/ | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| BookStack | <= 26.03 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 3, 2026 | New CVE Received | [email protected] |