What’s Vulnerable › Vulnerabilities

CVE-2026-86111: BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statuses

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-05 · updated 2026-09-08
• Weakness: CWE-639

Description

BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit view, bypassing the privacy protections documented for these message types.

Affected products

• bookwyrm-social bookwyrm: through 0.9.1

References

• https://github.com/bookwyrm-social/bookwyrm
• https://github.com/bookwyrm-social/bookwyrm/blob/v0.9.1/bookwyrm/templates/snippets/create_status/content_field.html
• https://github.com/bookwyrm-social/bookwyrm/blob/v0.9.1/bookwyrm/views/status.py
• https://github.com/geo-chen/oss/blob/main/bookwyrm.md#finding-1-authenticated-idor-in-editstatus-exposes-private-review-comment-and-quotation-content
• https://www.vulncheck.com/advisories/bookwyrm-through-0.9.1-insecure-direct-object-reference-in-editstatus-exposes-followers-only-and-direct-statuses
• https://github.com/geo-chen/oss/blob/main/bookwyrm.md#finding-1-authenticated-idor-in-editstatus-exposes-private-review-comment-and-quotation-content

Get alerted when CVE-2026-86111 or the next vulnerability affects your stack