CVE-2026-86112: BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpoints

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-05 · updated 2026-09-10
Weakness: CWE-639

Description

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create unauthorized interactions, trigger ActivityPub broadcasts, and enumerate private status IDs through response differentiation.

Affected products

bookwyrm-social bookwyrm: through 0.9.1

References

https://github.com/bookwyrm-social/bookwyrm
https://github.com/bookwyrm-social/bookwyrm/blob/v0.9.1/bookwyrm/views/interaction.py
https://github.com/geo-chen/oss/blob/main/bookwyrm.md#finding-2-authenticated-idor-in-favoriteunfavorite-allows-interaction-with-private-statuses
https://www.vulncheck.com/advisories/bookwyrm-through-0.9.1-missing-authorization-on-the-favorite-and-unfavorite-endpoints

Get alerted when CVE-2026-86112 or the next vulnerability affects your stack