CVE-2026-86111: BookWyrm Auth Bypass Vulnerability

CVE-2026-86111 Overview

CVE-2026-86111 is an Insecure Direct Object Reference (IDOR) vulnerability in BookWyrm, a federated social reading and reviewing platform. Versions through 0.9.1 fail to enforce visibility permissions in the status edit endpoint. Authenticated attackers can enumerate sequential status IDs and retrieve the raw content of followers-only and direct-message reviews, comments, and quotations. The flaw bypasses the privacy protections that BookWyrm documents for restricted status types. The issue is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact

Any authenticated BookWyrm user can read private followers-only and direct-message content belonging to other users by iterating status identifiers against the edit view.

Affected Products

• BookWyrm social reading platform
• All versions through 0.9.1
• Self-hosted BookWyrm instances exposing the edit_status endpoint

Discovery Timeline

• 2026-09-05 - CVE-2026-86111 published to the National Vulnerability Database
• 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86111

Vulnerability Analysis

BookWyrm exposes an edit view for user-authored statuses, including reviews, comments, and quotations. The endpoint accepts a status identifier as a path parameter and returns the underlying content for editing. The view validates that the requester is authenticated but does not verify that the requester is the author or a permitted audience member for the referenced status.

Because status IDs are sequential integers, attackers can iterate the ID space and issue a request for each identifier. When the endpoint returns content, the raw body of restricted statuses, including those marked followers or direct, is disclosed. This defeats the audience-scoping controls that BookWyrm applies to public list views and status pages.

The vulnerability affects confidentiality only. Attackers cannot modify statuses they do not own through this issue, but they can harvest private review content, quotations, and direct messages at scale.

Root Cause

The root cause is missing object-level authorization in the edit_status view within bookwyrm/views/status.py. The view resolves a status by primary key and renders the content field template without applying the visibility filter used elsewhere in the application. Authorization is inferred from session state rather than evaluated against the requested object.

Attack Vector

Exploitation requires only a valid authenticated session on the target instance. The attacker sends authenticated GET requests to the status edit URL, substituting sequential integer identifiers. The server returns HTML containing the raw status content for any existing record, regardless of the audience configured by the original author. Additional analysis is documented in the VulnCheck advisory and the OSS IDOR write-up.

// No verified exploit code available.
// See the linked VulnCheck advisory and OSS research write-up
// for a full technical walkthrough of the IDOR request pattern.

Detection Methods for CVE-2026-86111

Indicators of Compromise

• Bursts of authenticated GET requests to the edit_status URL pattern with sequentially incrementing status IDs from a single account or IP.
• Access to status edit URLs by users who are not the author and are not part of the audience.
• Anomalous spikes in 200 OK responses from the edit endpoint compared to baseline user behavior.

Detection Strategies

• Parse web server and application logs for requests to the BookWyrm status edit route and correlate the requesting user against the status author identifier.
• Alert on any account that requests more than a small number of distinct status IDs on the edit endpoint within a short window.
• Deploy application-layer rules that flag repeated 404 responses interleaved with 200 responses on the same route as an enumeration signal.

Monitoring Recommendations

• Instrument the edit endpoint to log the requester ID, target status ID, and status visibility level for offline analysis.
• Feed BookWyrm application logs into a centralized analytics platform to build baselines per user and detect deviations.
• Review outbound traffic from federated peers for scraping patterns targeting the edit endpoint on remote instances.

How to Mitigate CVE-2026-86111

Immediate Actions Required

• Upgrade BookWyrm to a version later than 0.9.1 once a patched release is available from the BookWyrm repository.
• Restrict new account registration on public instances until the patch is applied to reduce the pool of authenticated attackers.
• Audit application logs for prior enumeration activity against the status edit endpoint and notify affected users if private content was accessed.

Patch Information

No fixed version is listed in the NVD entry at publication time. Administrators should monitor the BookWyrm GitHub repository and the VulnCheck advisory for the release that introduces object-level authorization checks in the edit_status view.

Workarounds

• Apply a local patch to bookwyrm/views/status.py that returns HTTP 403 when the authenticated user is not the author of the requested status.
• Place the edit_status route behind a reverse proxy rule that rate-limits requests per authenticated session to hinder ID enumeration.
• Temporarily disable the edit workflow for status types where audience restrictions matter most, such as direct messages and followers-only reviews.

# Example nginx rate limit for the status edit route
limit_req_zone $binary_remote_addr zone=bw_edit:10m rate=5r/m;

location ~ ^/status/[0-9]+/edit {
    limit_req zone=bw_edit burst=3 nodelay;
    proxy_pass http://bookwyrm_upstream;
}