Authorization Bypass Vulnerability in BookWyrm Affects Reading Records
CVE-2026-86113

7.1HIGH

Key Information:

Vendor

Bookwyrm-social

Status
Bookwyrm
Vendor
CVE Published:
5 September 2026

What is CVE-2026-86113?

An authorization bypass vulnerability exists in the BookWyrm application through version 0.9.1, specifically in the edit_readthrough function. This flaw permits authenticated users to manipulate other users' reading entries by exploiting sequential ReadThrough IDs. As a consequence, it enables attackers to alter crucial reading metrics such as start dates, finish dates, progress levels, and modes, thereby compromising the integrity of reading statistics and any exported data.

Affected Version(s)

bookwyrm 0 <= 0.9.1

References

https://github.com/geo-chen/oss/blob/main/bookwyrm.md#fin...
technical-description
https://github.com/bookwyrm-social/bookwyrm/blob/v0.9.1/b...
technical-description
https://github.com/bookwyrm-social/bookwyrm
product

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.