CVE-2026-86112 Overview
CVE-2026-86112 is a missing authorization vulnerability in BookWyrm, an open-source federated social reading platform. The flaw affects BookWyrm versions through 0.9.1 and resides in the Favorite and Unfavorite views within bookwyrm/views/interaction.py. The application fails to validate user visibility permissions before processing favorite interactions. Authenticated attackers can favorite or unfavorite followers-only and direct statuses they otherwise cannot access. Successful exploitation triggers unauthorized ActivityPub broadcasts and allows enumeration of private status identifiers through response differentiation. The vulnerability is classified under [CWE-639] (Authorization Bypass Through User-Controlled Key).
Critical Impact
Authenticated attackers can interact with private statuses, generate unauthorized federation events, and enumerate private content IDs by observing endpoint responses.
Affected Products
- BookWyrm versions through 0.9.1
- BookWyrm Favorite view endpoint (bookwyrm/views/interaction.py)
- BookWyrm Unfavorite view endpoint (bookwyrm/views/interaction.py)
Discovery Timeline
- 2026-09-05 - CVE-2026-86112 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-86112
Vulnerability Analysis
BookWyrm implements status visibility levels including public, unlisted, followers-only, and direct. The Favorite and Unfavorite views accept a status identifier via POST and create or remove a favorite relationship. The views retrieve the target status by ID but omit the authorization check that verifies whether the requesting user is permitted to view that status. As a result, any authenticated user can interact with statuses restricted to specific followers or direct message recipients.
Because favoriting a status triggers an ActivityPub broadcast, the attacker can generate federation traffic on behalf of private content. The endpoints also return distinguishable responses for valid, invalid, and access-restricted status IDs, enabling attackers to enumerate private status identifiers by iterating through numeric ranges and observing response codes.
Root Cause
The root cause is an insecure direct object reference [CWE-639] in the interaction view logic. The Favorite and Unfavorite handlers resolve the requested status by primary key without invoking the visibility filter used elsewhere in the codebase. Authorization checks that gate reading a status are not applied when creating an interaction with it, breaking the assumption that only viewers of a status may interact with it.
Attack Vector
An attacker requires only an authenticated account on the target BookWyrm instance. The attacker sends a POST request to the favorite endpoint containing the numeric ID of a targeted followers-only or direct status. The server processes the interaction, records the favorite, and emits ActivityPub activity. By varying the status ID and comparing responses, the attacker enumerates private statuses without ever viewing their contents. See the OSS finding and the VulnCheck advisory for technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-86112
Indicators of Compromise
- Unusual volume of POST requests from a single authenticated user to the favorite or unfavorite endpoints across sequential status IDs.
- Favorite records associated with statuses whose author has no follow relationship with the interacting user.
- Outbound ActivityPub Like or Undo activities referencing statuses with followers or direct visibility.
Detection Strategies
- Instrument the Favorite and Unfavorite views to log the status visibility level and the relationship between the acting user and the status author.
- Alert on interactions where the acting user is not in the audience of a followers-only or direct status.
- Baseline normal favorite request rates per user and flag rapid sequential ID access patterns indicative of enumeration.
Monitoring Recommendations
- Ingest BookWyrm web server access logs into a centralized log platform and monitor POST rates against /favorite/ and /unfavorite/ paths.
- Track ActivityPub outbound queue entries and correlate them with the source user and target status visibility.
- Review database entries in the favorites table for anomalies where the favoriter lacks read access to the referenced status.
How to Mitigate CVE-2026-86112
Immediate Actions Required
- Restrict or disable the Favorite and Unfavorite endpoints at the reverse proxy layer until a patched version is deployed.
- Audit recent favorite records against status visibility levels and remove unauthorized interactions.
- Rotate credentials for accounts observed enumerating status IDs and review associated federation traffic.
Patch Information
At the time of the NVD publication, BookWyrm versions through 0.9.1 are affected. Monitor the BookWyrm GitHub repository for a fixed release and apply the update immediately once available. The fix must add visibility enforcement to the Favorite and Unfavorite views in bookwyrm/views/interaction.py so that interactions are permitted only when the acting user is in the status audience.
Workarounds
- Apply a local patch that invokes the same visibility filter used by status detail views before creating or deleting a favorite record.
- Add rate limiting on the favorite and unfavorite endpoints to slow enumeration attempts against private status IDs.
- Restrict registrations on federated instances to trusted users to reduce the pool of potential authenticated attackers.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
