CVE-2026-86111

MEDIUM 6.5

BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statuses

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit view, bypassing the privacy protections documented for these message types.

CWE	CWE-639
Vendor	bookwyrm-social
Product	bookwyrm
Published	Sep 5, 2026
Last Updated	Sep 8, 2026

Stay Ahead of the Next One

Get instant alerts for bookwyrm-social bookwyrm

Be the first to know when new medium vulnerabilities affecting bookwyrm-social bookwyrm are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

bookwyrm-social / bookwyrm

0 ≤ 0.9.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/geo-chen/oss/blob/main/bookwyrm.md#finding-1-authenticated-idor-in-editstatus-exposes-private-review-comment-and-quotation-content github.com: https://github.com/bookwyrm-social/bookwyrm/blob/v0.9.1/bookwyrm/views/status.py github.com: https://github.com/bookwyrm-social/bookwyrm/blob/v0.9.1/bookwyrm/templates/snippets/create_status/content_field.html github.com: https://github.com/bookwyrm-social/bookwyrm vulncheck.com: https://www.vulncheck.com/advisories/bookwyrm-through-0.9.1-insecure-direct-object-reference-in-editstatus-exposes-followers-only-and-direct-statuses

Credits

🔍 George Chen