CVE-2026-86113 Details
Description
BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to modify other users' reading records. Attackers can exploit sequential ReadThrough IDs to overwrite arbitrary users' start dates, finish dates, progress, and progress mode, affecting reading statistics and exported data.
An authorization bypass vulnerability has been identified in BookWyrm versions through 0.9.1, specifically within the 'edit_readthrough' function. This vulnerability allows authenticated users to manipulate other users' reading records by overwriting details such as start dates, finish dates, progress, and progress modes. The issue arises because the function fails to verify ownership of the reading records before applying the changes. Exploitation of this vulnerability can disrupt individual reading statistics and affect data exported from the platform.
Users are advised to update to BookWyrm version 0.9.3 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 5, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| BookWyrm | <= 0.9.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 5, 2026 | New CVE Received | [email protected] |