Authorization Flaw in BookWyrm Leading to Unauthorized Interactions

CVE-2026-86112

What is CVE-2026-86112?

BookWyrm versions up to 0.9.1 contain an authorization vulnerability in the Favorite and Unfavorite functionalities. This issue arises from the failure to properly validate user visibility permissions, allowing authenticated attackers to favorite or unfavorite statuses that are meant to be private or followers-only. By exploiting this flaw, attackers can POST to the favorite endpoint using a status ID, resulting in unauthorized actions that trigger ActivityPub broadcasts. The vulnerability also enables attackers to enumerate private status IDs, creating further privacy risks for affected users.

References