Medium severity5.4NVD Advisory· Published Sep 5, 2026

CVE-2026-86112

Description

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create unauthorized interactions, trigger ActivityPub broadcasts, and enumerate private status IDs through response differentiation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Bookwyrm Social/Bookwyrmllm-fuzzy
Range: <=0.9.1

Patches

Vulnerability mechanics

References

github.com/bookwyrm-social/bookwyrm/blob/v0.9.1/bookwyrm/views/interaction.pynvd
github.com/geo-chen/oss/blob/main/bookwyrm.mdnvd
www.vulncheck.com/advisories/bookwyrm-through-0.9.1-missing-authorization-on-the-favorite-and-unfavorite-endpointsnvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000