Medium severity6.5NVD Advisory· Published Sep 5, 2026

CVE-2026-86113

Description

BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to modify other users' reading records. Attackers can exploit sequential ReadThrough IDs to overwrite arbitrary users' start dates, finish dates, progress, and progress mode, affecting reading statistics and exported data.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Bookwyrm Social/Bookwyrmllm-fuzzy
Range: <=0.9.1

Patches

Vulnerability mechanics

References

github.com/bookwyrm-social/bookwyrm/blob/v0.9.1/bookwyrm/views/status.pynvd
github.com/geo-chen/oss/blob/main/bookwyrm.mdnvd
www.vulncheck.com/advisories/bookwyrm-through-0.9.1-insecure-direct-object-reference-in-edit-readthrough-allows-tampering-with-other-users-reading-recordsnvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000