CVE-2026-86112CWE-639

CVE-2026-86112

Medium · published September 5, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
22.0
In the wild
Unconfirmed
What it is

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create unauthorized interactions, trigger ActivityPub broadcasts, and enumerate private status IDs through response differentiation.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00304 · 22.0th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-05T14:16Z
References (4)
https://github.com/bookwyrm-social/bookwyrm · [email protected]https://github.com/bookwyrm-social/bookwyrm/blob/v0.9.1/bookwyrm/views/interaction.py · [email protected]https://github.com/geo-chen/oss/blob/main/bookwyrm.md#finding-2-authenticated-idor-in-favoriteunfavorite-allows-interaction-with-private-statuses · [email protected]https://www.vulncheck.com/advisories/bookwyrm-through-0.9.1-missing-authorization-on-the-favorite-and-unfavorite-endpoints · [email protected]
EPSS history
Timeline
  • 07 SEP 03:36Z
    EPSS moved — → 0%
    epss
  • 05 SEP 09:59Z
    BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpoints
    cvelistv5