CVE-2026-86111 in BookWyrm
Summary
by MITRE • 09/05/2026
BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit view, bypassing the privacy protections documented for these message types.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified in BookWyrm versions up to 0.9.1 represents a critical failure in Access Control logic within the application's status editing endpoint. This flaw stems from an insufficient validation of user visibility permissions when processing requests to modify or retrieve existing statuses. In secure software architecture, endpoints that handle sensitive data must rigorously verify that the requesting entity possesses explicit authorization for both reading and modifying the specific resource being accessed. However, in this implementation, the server fails to enforce these checks adequately during the edit operation, creating a significant gap between the intended security policy and its actual execution. This type of flaw is classically categorized under CWE-284 Improper Access Control, specifically reflecting an inability to restrict access to resources based on user identity or role privileges.
The operational impact of this vulnerability allows authenticated attackers to bypass privacy protections designed for followers-only reviews and direct messages. By exploiting the lack of proper permission checks, an attacker can enumerate sequential status IDs associated with other users' accounts. Once a valid ID is identified through enumeration techniques, the attacker can send requests to the edit endpoint which inadvertently returns or exposes the raw content of these restricted statuses. This effectively neutralizes the privacy features intended for private communications and exclusive follower-only content, leading to an unauthorized disclosure of sensitive information. The ability to read direct messages constitutes a severe breach of confidentiality, potentially exposing personal conversations, financial details, or other confidential data shared between users under the assumption that such exchanges are secure from third-party observation.
This vulnerability aligns with several entries in the MITRE ATT&CK framework, particularly those related to Collection and Exfiltration via Application Layer Protocols. The use of sequential ID enumeration is a common technique for discovering hidden resources within web applications, often referred to as Insecure Direct Object Reference (IDOR) when combined with insufficient access control checks. Attackers can leverage this flaw to build profiles on target users by aggregating private data points over time. The persistence of such vulnerabilities in social networking platforms poses significant risks not only to individual privacy but also to the overall trustworthiness of the platform, as users rely on these mechanisms for safe communication and content sharing.
Mitigation strategies must focus on implementing robust authorization checks at every stage of request processing within the status edit endpoint. Developers should ensure that before any data is retrieved or modified, the system explicitly verifies that the authenticated user owns the resource or has been granted explicit permission to view it by its creator. This involves checking database records against session tokens and validating ownership constraints strictly server-side rather than relying on client-side indicators which can be easily manipulated. Additionally, implementing rate limiting and anomaly detection for sequential ID requests can help mitigate enumeration attacks while more permanent code fixes are deployed. Regular security audits focusing on access control logic and penetration testing that specifically targets privacy boundaries are essential to prevent similar vulnerabilities in future releases of the software.