ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-86113

bookwyrm · Vulnerability

CVSS 4.0 7.1 HIGHCVSS 3.1 6.5 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-86113

Published

BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to modify other users' reading records. Attackers can exploit sequential ReadThrough IDs to overwrite arbitrary users' start dates, finish dates, progress, and progress mode, affecting reading statistics and exported data.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-86113

Published

bookwyrm

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "bookwyrm-social",
                    "product": "bookwyrm",
                    "repo": "https://github.com/bookwyrm-social/bookwyrm",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:github/bookwyrm-social/bookwyrm",
                    "versions": [
                        {
                            "version": "0",
                            "lessThanOrEqual": "0.9.1",
                            "status": "affected",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON