Description
BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create unauthorized interactions, trigger ActivityPub broadcasts, and enumerate private status IDs through response differentiation.
Published: 2026-09-05
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized interaction and information disclosure on private statuses
Action: Apply Patch
AI Analysis

Impact

The vulnerability is a missing authorization check on BookWyrm’s favorite and unfavorite endpoints. Authenticated attackers can POST a request with the ID of a private status they cannot normally view, causing the system to create an interaction and broadcast it via ActivityPub. Because the server’s responses differ when the status is private, an attacker can enumerate private status identifiers by measuring response variations.

Affected Systems

BookWyrm versions through 0.9.1 are affected. The vulnerability is tied to the BookWyrm Social platform and impacts all installations running the 0.9.1 release or earlier. Higher versions resolved the issue, but the exact patch version is not listed in the provided data.

Risk and Exploitability

The CVSS score of 5.3 classifies the issue as moderate severity. Evidence of exploitation is not yet documented in KEV and no EPSS score is available. Attackers must be authenticated and target public or private status IDs they are unauthorized to view. They can not elevate privileges to system level but can extract private status identifiers and cause unwanted ActivityPub traffic, which may lead to privacy exposure and potential denial of service if triggered at scale.

Generated by OpenCVE AI on September 5, 2026 at 11:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a BookWyrm release beyond 0.9.1 that includes the authorization check for favorite and unfavorite endpoints.
  • If an upgrade is not immediately feasible, patch the interaction view to verify that the authenticated user has visibility rights to the status before processing favorite or unfavorite requests.
  • Add monitoring or rate‑limit rules for POST requests to the favorite/unfavorite endpoints to detect and mitigate enumeration attempts.

Generated by OpenCVE AI on September 5, 2026 at 11:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 10 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 07 Sep 2026 08:45:00 +0000

Type Values Removed Values Added
First Time appeared Bookwyrm-social
Bookwyrm-social bookwyrm
Vendors & Products Bookwyrm-social
Bookwyrm-social bookwyrm

Sat, 05 Sep 2026 10:15:00 +0000

Type Values Removed Values Added
Description BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create unauthorized interactions, trigger ActivityPub broadcasts, and enumerate private status IDs through response differentiation.
Title BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpoints
First Time appeared Joinbookwyrm
Joinbookwyrm bookwyrm
Weaknesses CWE-639
CPEs cpe:2.3:a:joinbookwyrm:bookwyrm:*:*:*:*:*:*:*:*
Vendors & Products Joinbookwyrm
Joinbookwyrm bookwyrm
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Bookwyrm-social Bookwyrm
Joinbookwyrm Bookwyrm
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-24T14:20:59.482Z

Reserved: 2026-09-05T01:59:19.567Z

Link: CVE-2026-86112

cve-icon Vulnrichment

Updated: 2026-09-10T14:19:14.939Z

cve-icon NVD

Status : Deferred

Published: 2026-09-05T10:16:42.130

Modified: 2026-09-10T16:18:01.420

Link: CVE-2026-86112

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T08:25:23Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key