Vulnerability · Published Sep 5, 2026 · Assigned by VulnCheck

CVE-2026-86113BookWyrm through 0.9.1 Insecure Direct Object Reference in edit-readthrough Allows Tampering with Other Users' Reading Records

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in bookwyrm from bookwyrm-social. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 63.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to modify other users' reading records. Attackers can exploit sequential ReadThrough IDs to overwrite arbitrary users' start dates, finish dates, progress, and progress mode, affecting reading statistics and exported data.

Affected products (as reported)

Vendor	Product	Versions
bookwyrm-social	bookwyrm	0 – through 0.9.1

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

Researcher write-up: finding 3 technical-description
edit_readthrough: no ownership check technical-description
https://github.com/bookwyrm-social/bookwyrm product
VulnCheck Advisory: BookWyrm through 0.9.1 Insecure Direct Object Reference in edit-readthrough Allows Tampering with Other Users' Reading Records third-party-advisory