Impact

The name of a restricted book could be viewed by non-authorised users when the book was on a shelf, and the shelves were viewed in "List View". This could expose book names to those that did not have permission to see them, when part of a shelf.

Patches

This has been patched in version v0.29.3.

Workarounds

Please update otherwise you could temporarily change the name of any private books to remove any sensitive content.

References

• BookStack Beta v0.29.3
• GitHub Issue #2111

For more information

If you have any questions or comments about this advisory:

• Open an issue in the BookStack GitHub repository.
• Ask on the BookStack Discord chat.
• Follow the BookStack Security Advice to contact someone privately.