Vulnerability · Published Sep 5, 2026 · Assigned by VulnCheck

CVE-2026-86111BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statuses

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in bookwyrm from bookwyrm-social. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 61.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit view, bypassing the privacy protections documented for these message types.

Affected products (as reported)

Vendor	Product	Versions
bookwyrm-social	bookwyrm	0 – through 0.9.1

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Researcher write-up: finding 1 technical-description
EditStatus.get: no visibility check technical-description
compose template renders draft.raw_content technical-description
https://github.com/bookwyrm-social/bookwyrm product
VulnCheck Advisory: BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statuses third-party-advisory