Security app updates, Part 1: the triage of 38 flagged pins (TRIAGE.md, per-app notes, PICKS.md); R-1306 triaged; R-1310 (watch classifier) and R-1311 (Termix X-Forwarded-For) filed

documentation/audits/security-app-updates-2026-10-27/triage-notes/bookstack.md

@@ -0,0 +1,20 @@
+# bookstack — triage (group D)
+Pins: lscr.io/linuxserver/bookstack:26.09.1, mariadb:12.3 (no notices). Gates: none (own login only).
+
+## Notice: release:BookStackApp/BookStack@v26.09.2 — REAL (app security release)
+Read body of v26.09.2 (2026-10-20). Fixes: (1) comments of pages in the recycle bin still visible to API users;
+(2) attachments of draft pages modifiable by other users holding attachment update/delete permission. Hardening: password
+change drops remember-me cookies, ZIP import uncompressed-size check, SAML2 route CSRF-logout nuisance, PHP packages.
+- Severity: unrated upstream (no GHSA); my read: low-medium (authorisation leaks between logged-in users).
+- Login: any user (API access / attachment permission). Reachable: yes, but only to an account holder.
+
+## Fix / target
+Smallest fix: v26.09.2. Newest stable in main 26: v26.09.2 (newest release in the list).
+TARGET: `lscr.io/linuxserver/bookstack:26.09.2` — exists on Docker Hub (2026-10-26, same digest as v26.09.2-ls293).
+Tag style matches our pin (linuxserver bare version tag; it is re-pushed per ls build — ls291..ls293 so far).
+Same main: yes (26). Breaking: none found (read v26.09.1, v26.09.2; APP_KEY requirement came in v26.09, already behind us).
+linuxserver changelog: nothing since 05.08.26.
+Lane: SECURITY_FIX.
+
+Classifier note: `behind` = `26.09.20260929` is wrong — linuxserver's date-suffixed tag for v26.09 sorts above 26.09.x;
+ignore `YY.MM.YYYYMMDD` tags when computing "behind".