CVE-2026-86112 — BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpoints
BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-o…
Published: 2026-09-05 · CVSS: 5.3 · CVSS 4.0
BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create unauthorized interactions, trigger ActivityPub broadcasts, and enumerate private status IDs through response differentiation.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7