CVE-2026-86111CWE-639

CVE-2026-86111

Medium · published September 5, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
36.8
In the wild
Unconfirmed
What it is

BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit view, bypassing the privacy protections documented for these message types.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00436 · 36.8th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-05T14:16Z
References (6)
https://github.com/bookwyrm-social/bookwyrm · [email protected]https://github.com/bookwyrm-social/bookwyrm/blob/v0.9.1/bookwyrm/templates/snippets/create_status/content_field.html · [email protected]https://github.com/bookwyrm-social/bookwyrm/blob/v0.9.1/bookwyrm/views/status.py · [email protected]https://github.com/geo-chen/oss/blob/main/bookwyrm.md#finding-1-authenticated-idor-in-editstatus-exposes-private-review-comment-and-quotation-content · [email protected]https://www.vulncheck.com/advisories/bookwyrm-through-0.9.1-insecure-direct-object-reference-in-editstatus-exposes-followers-only-and-direct-statuses · [email protected]https://github.com/geo-chen/oss/blob/main/bookwyrm.md#finding-1-authenticated-idor-in-editstatus-exposes-private-review-comment-and-quotation-content · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 07 SEP 03:36Z
    EPSS moved — → 0%
    epss
  • 05 SEP 09:59Z
    BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statuses
    cvelistv5