CVE-2026-86112
Received Received - Intake

BookWyrm Unauthorized Favorite Interaction via ActivityPub

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: VulnCheck

Description
BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create unauthorized interactions, trigger ActivityPub broadcasts, and enumerate private status IDs through response differentiation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-86112
EUVD
EUVD-2026-71944

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
bookwyrm bookwyrm 0.9.1
bookwyrm bookwyrm 0.8.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86112 is an Insecure Direct Object Reference (IDOR) vulnerability in BookWyrm through version 0.9.1. It allows authenticated attackers to favorite or unfavorite statuses they cannot access, including followers-only and direct messages. Attackers can POST to the favorite endpoint with a status ID to create unauthorized interactions, trigger notifications, and enumerate private status IDs by observing response differences.

Detection Guidance

To detect this vulnerability, monitor HTTP POST requests to the /favorite and /unfavorite endpoints in BookWyrm. Check for requests with status IDs that should be inaccessible due to visibility restrictions. Use tools like curl to test endpoints: curl -X POST -d 'status_id=<private_status_id>' http://<bookwyrm_url>/favorite. Compare responses for valid vs invalid status IDs to identify unauthorized access attempts.

Impact Analysis

This vulnerability allows attackers to access private content, manipulate user data like reading progress, and trigger unwanted notifications. It can expose sensitive information such as private reviews, comments, or direct messages, and alter user statistics without authorization.

Compliance Impact

This vulnerability likely violates privacy regulations like GDPR and HIPAA by enabling unauthorized access to private user data, exposing sensitive information, and failing to enforce proper data protection controls. It undermines user consent and data integrity requirements.

Mitigation Strategies

Immediately update BookWyrm to the latest patched version. If an update is unavailable, restrict access to the /favorite and /unfavorite endpoints by implementing proper authorization checks. Review logs for unauthorized interaction attempts and notify affected users. Disable ActivityPub broadcasts temporarily if the vulnerability is actively exploited.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86112. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart