The vulnerability resides in the edit_readthrough function of BookWyrm up to version 0.9.1. An authenticated user can supply a ReadThrough ID belonging to another user and modify that user's start date, finish date, progress value, and progress mode. This authorization bypass exposes a classic Insecure Direct Object Reference flaw identified as CWE‑639, allowing unauthorized modification of user‑owned data.

All releases of BookWyrm from the outset through version 0.9.1 are affected. The product, BookWyrm, is distributed as the bookwyrm-social:bookwyrm project and is identified in the CPE space as joinbookwyrm:bookwyrm. Administrators should verify whether their installation is running any of these versions and coordinate with the maintainers for an update.

The CVSS score of 7.1 indicates high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but the fact that only an authenticated user is required and that ReadThrough IDs can be enumerated sequentially means the risk of exploitation is real. Based on the description, it is inferred that an attacker can enumerate consecutive ReadThrough identifiers through the web interface and overwrite arbitrary users' reading progress, thereby corrupting summary or exported data and potentially facilitating data manipulation or defacement.