1.5 KiB
bookstack — triage (group D)
Pins: lscr.io/linuxserver/bookstack:26.09.1, mariadb:12.3 (no notices). Gates: none (own login only).
Notice: release:BookStackApp/BookStack@v26.09.2 — REAL (app security release)
Read body of v26.09.2 (2026-10-20). Fixes: (1) comments of pages in the recycle bin still visible to API users; (2) attachments of draft pages modifiable by other users holding attachment update/delete permission. Hardening: password change drops remember-me cookies, ZIP import uncompressed-size check, SAML2 route CSRF-logout nuisance, PHP packages.
- Severity: unrated upstream (no GHSA); my read: low-medium (authorisation leaks between logged-in users).
- Login: any user (API access / attachment permission). Reachable: yes, but only to an account holder.
Fix / target
Smallest fix: v26.09.2. Newest stable in main 26: v26.09.2 (newest release in the list).
TARGET: lscr.io/linuxserver/bookstack:26.09.2 — exists on Docker Hub (2026-10-26, same digest as v26.09.2-ls293).
Tag style matches our pin (linuxserver bare version tag; it is re-pushed per ls build — ls291..ls293 so far).
Same main: yes (26). Breaking: none found (read v26.09.1, v26.09.2; APP_KEY requirement came in v26.09, already behind us).
linuxserver changelog: nothing since 05.08.26.
Lane: SECURITY_FIX.
Classifier note: behind = 26.09.20260929 is wrong — linuxserver's date-suffixed tag for v26.09 sorts above 26.09.x;
ignore YY.MM.YYYYMMDD tags when computing "behind".