CVE-2026-86113: BookWyrm Authorization Bypass Vulnerability

CVE-2026-86113 Overview

CVE-2026-86113 is an authorization bypass vulnerability in BookWyrm, a federated social reading and reviewing platform. Versions through 0.9.1 contain an Insecure Direct Object Reference (IDOR) in the edit_readthrough function within bookwyrm/views/status.py. Authenticated users can modify reading records belonging to other users by supplying a ReadThrough identifier that they do not own. Because ReadThrough records use sequential integer IDs, attackers can enumerate and overwrite arbitrary users' start dates, finish dates, progress values, and progress mode. The tampering corrupts reading statistics and any exported data derived from those records. The issue is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact

Any authenticated BookWyrm user can silently overwrite the reading progress, start dates, and finish dates of any other user by iterating sequential ReadThrough IDs.

Affected Products

• BookWyrm through version 0.9.1
• bookwyrm/views/status.py — edit_readthrough view handler
• Deployments exposing the /edit-readthrough/<id>/ endpoint to authenticated users

Discovery Timeline

• 2026-09-05 - CVE-2026-86113 published to NVD
• 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86113

Vulnerability Analysis

BookWyrm exposes an edit_readthrough view that accepts a ReadThrough primary key from the request and updates the corresponding record. The handler authenticates the caller but does not verify that the caller owns the referenced ReadThrough object. Because ReadThrough rows are assigned auto-incrementing integer primary keys, an attacker can iterate IDs from 1 upward and submit modified start_date, finish_date, progress, and progress_mode fields for records belonging to other users. The server persists the changes without an ownership check, so the target user's reading history is silently rewritten.

Root Cause

The root cause is a missing authorization check between the authenticated session and the object referenced by the request. The view relies on the presence of a valid session to gate access to the update operation, but it does not compare readthrough.user to request.user before saving. This pattern maps directly to CWE-639, where the application uses a user-controlled key to select a resource without validating that the caller is entitled to it.

Attack Vector

Exploitation requires a low-privileged authenticated account on the target BookWyrm instance. The attacker submits a POST request to the edit_readthrough endpoint with a ReadThrough ID belonging to another user and arbitrary date or progress values. No user interaction from the victim is required. Because ReadThrough IDs are sequential, mass tampering across the instance is trivial through simple enumeration. Confidentiality and availability are not directly affected, but integrity of user reading data is fully compromised.

No verified public exploit code is available. Technical details are documented in the independent IDOR finding report and the VulnCheck advisory. The vulnerable handler can be reviewed in the status view source.

Detection Methods for CVE-2026-86113

Indicators of Compromise

• POST requests to /edit-readthrough/<id>/ where the referenced ReadThrough.user_id does not match the authenticated session user.
• Sequential access patterns from a single account touching many distinct ReadThrough IDs in a short window.
• Reading records with start_date, finish_date, or progress values inconsistent with the owning user's historical activity or with the associated book publication date.

Detection Strategies

• Enable database auditing on the bookwyrm_readthrough table and alert when an update is committed by a session user who does not own the row.
• Add application-layer logging inside edit_readthrough that records both request.user.id and readthrough.user_id on every invocation, then alert on mismatches.
• Correlate web server access logs to identify accounts issuing high-volume requests against enumerated ReadThrough IDs.

Monitoring Recommendations

• Baseline normal edit rates per user for reading records and alert on statistical outliers.
• Forward BookWyrm application logs into a centralized SIEM or data lake for retention and cross-user correlation.
• Periodically diff exported reading statistics against database snapshots to detect silent tampering.

How to Mitigate CVE-2026-86113

Immediate Actions Required

• Restrict access to the BookWyrm instance to trusted users pending an upstream fix, or take the edit_readthrough route offline via reverse-proxy rules.
• Audit the bookwyrm_readthrough table for records whose updated_date is more recent than expected relative to the owning user's activity.
• Rotate session cookies and review recent authenticated account creations for signs of abuse.

Patch Information

No fixed version is identified in the NVD entry at the time of publication. The vulnerability affects BookWyrm through 0.9.1. Monitor the BookWyrm GitHub repository and the VulnCheck advisory for a released patch and upgrade once available.

Workarounds

• Patch the edit_readthrough view locally to verify readthrough.user_id == request.user.id before saving, returning HTTP 403 on mismatch.
• Enforce reverse-proxy access control lists that block the /edit-readthrough/ route for untrusted authenticated users.
• Replace sequential integer primary keys on ReadThrough with unguessable identifiers such as UUIDs to raise the cost of enumeration, while treating this only as defense in depth alongside a proper authorization check.

# Nginx reverse-proxy example: block edit_readthrough until patched
location ~ ^/edit-readthrough/ {
    return 403;
}