Medium severity6.5NVD Advisory· Published Sep 5, 2026
CVE-2026-86111
CVE-2026-86111
Description
BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit view, bypassing the privacy protections documented for these message types.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=0.9.1
Patches
Vulnerability mechanics
References
4- github.com/bookwyrm-social/bookwyrm/blob/v0.9.1/bookwyrm/templates/snippets/create_status/content_field.htmlnvd
- github.com/bookwyrm-social/bookwyrm/blob/v0.9.1/bookwyrm/views/status.pynvd
- github.com/geo-chen/oss/blob/main/bookwyrm.mdnvd
- www.vulncheck.com/advisories/bookwyrm-through-0.9.1-insecure-direct-object-reference-in-editstatus-exposes-followers-only-and-direct-statusesnvd
News mentions
0No linked articles in our index yet.