BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpoints
BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create unauthorized interactions, trigger ActivityPub broadcasts, and enumerate private status IDs through response differentiation.
CVE-2026-86112
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-86112
bookwyrm
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/bookwyrm-social/bookwyrm",
"vendor": "bookwyrm-social",
"product": "bookwyrm",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "semver",
"lessThanOrEqual": "0.9.1"
}
],
"packageURL": "pkg:github/bookwyrm-social/bookwyrm",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-86112
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #1573 · Revision 1
- Added to Heist Feed
- Publisher date