Vulnerability details
CVE-2026-86111
bookwyrm-social bookwyrm
BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statuses
CVSS 4.0
7.1High
Official description
BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit view, bypassing the privacy protections documented for these message types.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.1High | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| 6.5Medium | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| bookwyrm-social | bookwyrm | v ≤ 0.9.1 | CVEProject cvelistV5 (CNA) |
References and advisories
5- https://github.com/bookwyrm-social/bookwyrm/blob/v0.9.1/bookwyrm/views/status.py technical-description
- https://github.com/bookwyrm-social/bookwyrm/blob/v0.9.1/bookwyrm/templates/snippets/create_status/content_field.html technical-description
- https://github.com/bookwyrm-social/bookwyrm product
- https://www.vulncheck.com/advisories/bookwyrm-through-0.9.1-insecure-direct-object-reference-in-editstatus-exposes-followers-only-and-direct-statuses third-party-advisory
- https://github.com/geo-chen/oss/blob/main/bookwyrm.md#finding-1-authenticated-idor-in-editstatus-exposes-private-review-comment-and-quotation-content technical-description
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-09-05
- Last updated
- 2026-09-24
- State
- Published
- Assigner (CNA)
- VulnCheck
Exploit prediction (EPSS)
0.43%
Probability of exploitation in 30 days
38%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-639Authorization Bypass Through User-Controlled Key