CVE-2026-86111 Details
Description
BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit view, bypassing the privacy protections documented for these message types.
A vulnerability exists in BookWyrm versions through 0.9.1, where the status edit endpoint fails to properly validate user visibility permissions. This oversight allows authenticated users to access and read reviews marked as followers-only or direct messages by exploiting an Insecure Direct Object Reference (IDOR). The vulnerability arises because the endpoint does not enforce privacy settings, enabling users to enumerate sequential status IDs and retrieve restricted content. The issue bypasses the documented privacy protections for these message types, exposing private reviews, comments, and quotations to unauthorized users.
Users can update to BookWyrm version 0.9.3 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 5, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| BookWyrm | <= 0.9.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 5, 2026 | New CVE Received | [email protected] |