# BookStack v26.03.5 — BookStack v26.03.5

- Product: BookStack (https://whatsnew.fyi/product/bookstack)
- Vendor: Dan Brown
- Date: 2026-05-21
- Version: v26.03.5
- Original notes: https://github.com/BookStackApp/BookStack/releases/tag/v26.03.5
- Permalink: https://whatsnew.fyi/product/bookstack/releases/v26.03.5

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Address brute-force based vulnerability related to multi-factor authentication
- **security** — Update PHP package versions to help avoid potential vulnerabilities
- **changed** — Update MFA verification routes with rate limiting

###### Security Release

* [Update Instructions](https://www.bookstackapp.com/docs/admin/updates)
* [Update details on blog](https://www.bookstackapp.com/blog/bookstack-release-v26-03-5/)

This is a security release to address a brute-force based vulnerability related to multi-factor authentication, and to update project libraries to help avoid potential vulnerabilities that have been reported in those.

Upgrade is generally advised, but strongly so where multi-factor authentication is used & considered as a critical layer of defense.

Thanks to Stephen O. / Sakusen ([Codeberg](https://codeberg.org/Sakusen), [Website](https://sakusen.dev/))  for responsibly reporting these issues.

###### Full List of Changes

* Updated PHP package versions.
* Updated MFA verification routes with rate limiting.