BookWyrm 0.9.1 onward lacks visibility validation in its status edit endpoint. This allows any authenticated user to enumerate sequential status identifiers and access the raw content of followers‑only or direct‑message statuses by requesting the edit view. The resulting breach is the disclosure of private status content, exposing sensitive user interactions that were intended to be invisible to non-followers.

BookWyrm, as published by bookwyrm‑social, is affected in releases up to and including 0.9.1. Users operating those versions run the risk of the described information‑disclosure flaw unless updated.

The CVSS score of 7.1 denotes a medium severity vulnerability, while the EPSS score is unavailable. The flaw is not listed in the CISA KEV catalog. Attackers need valid authentication and can perform ID enumeration by sequentially adjusting the status ID in the edit URL. Once the ID is within the authorized range, the endpoint serves payload without verifying the viewer's permission, making exploitation straightforward for an attacker with a normal user account.