Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-86112

BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpoints

CVSS 4.0 5.3 MEDIUMCVSS 3.1 5.4 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-86112

Published

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create unauthorized interactions, trigger ActivityPub broadcasts, and enumerate private status IDs through response differentiation.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-86112

Published

bookwyrm

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "bookwyrm-social",
                    "product": "bookwyrm",
                    "repo": "https://github.com/bookwyrm-social/bookwyrm",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:github/bookwyrm-social/bookwyrm",
                    "versions": [
                        {
                            "version": "0",
                            "lessThanOrEqual": "0.9.1",
                            "status": "affected",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON