CVE-2026-86112
BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpoints
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create unauthorized interactions, trigger ActivityPub broadcasts, and enumerate private status IDs through response differentiation.
| CWE | CWE-639 |
| Vendor | bookwyrm-social |
| Product | bookwyrm |
| Published | Sep 5, 2026 |
| Last Updated | Sep 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for bookwyrm-social bookwyrm
Be the first to know when new medium vulnerabilities affecting bookwyrm-social bookwyrm are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
bookwyrm-social / bookwyrm
0 ≤ 0.9.1
References
github.com: https://github.com/geo-chen/oss/blob/main/bookwyrm.md#finding-2-authenticated-idor-in-favoriteunfavorite-allows-interaction-with-private-statuses github.com: https://github.com/bookwyrm-social/bookwyrm/blob/v0.9.1/bookwyrm/views/interaction.py github.com: https://github.com/bookwyrm-social/bookwyrm vulncheck.com: https://www.vulncheck.com/advisories/bookwyrm-through-0.9.1-missing-authorization-on-the-favorite-and-unfavorite-endpoints
Credits
🔍 George Chen