CVE-2026-86113 in BookWyrm
Summary
by MITRE • 09/05/2026
BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to modify other users' reading records. Attackers can exploit sequential ReadThrough IDs to overwrite arbitrary users' start dates, finish dates, progress, and progress mode, affecting reading statistics and exported data.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/05/2026
The identified security flaw resides within the BookWyrm application, specifically in the edit_readthrough function of versions up through 0.9.1. This vulnerability constitutes a critical authorization bypass that undermines the fundamental principle of access control by allowing authenticated users to manipulate data belonging to other distinct user accounts. The core technical issue stems from insufficient validation of resource ownership during the update operation. When an attacker submits a request to modify reading records, the application fails to verify whether the target readthrough entry belongs to the currently authenticated session or if it is associated with a different user identity. This oversight enables malicious actors to exploit sequential identifiers inherent in database structures, where ReadThrough IDs are often assigned incrementally and predictably. By manipulating these predictable ID sequences, an attacker can systematically iterate through potential record identifiers until they locate entries belonging to other users, thereby gaining the ability to overwrite critical metadata associated with those records without proper authorization checks.
The operational impact of this vulnerability is significant for both individual privacy and data integrity within the social reading platform. Attackers can arbitrarily alter start dates, finish dates, progress percentages, and progress modes for any targeted user's library entries. This capability allows an adversary to fabricate reading histories, potentially inflating or deflating a victim's perceived engagement with specific titles. Such manipulation distorts personal analytics and reading statistics that users rely on for tracking their literary consumption habits. Furthermore, because these records often feed into exported data sets used by the community for recommendations, leaderboards, or social sharing features, the integrity of shared platform metrics is compromised. The ability to falsify completion status can also mislead other users who might trust aggregated reading trends generated from this corrupted data, thereby eroding trust in the platform's reliability and accuracy.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Assignment, as well as CWE-862, Missing Authorization Check. The exploitation technique leverages predictable resource identifiers to bypass access controls, reflecting patterns often seen in Broken Object Level Authorization (BOLA) scenarios, although the specific mechanism here relies on ID enumeration rather than direct parameter manipulation of a single known object. In terms of the MITRE ATT&CK framework, this behavior corresponds to T1078 Valid Accounts, as it requires initial authentication, and potentially relates to data exfiltration or modification tactics depending on the attacker's ultimate goal, such as social engineering preparation by fabricating reading interests that align with a target's profile.
To mitigate this vulnerability, developers must implement strict object-level authorization checks within the edit_readthrough function. The application should verify that the user initiating the request is the legitimate owner of the readthrough record being modified before processing any updates to start dates, finish dates, progress metrics, or modes. This validation should be performed at the database query level by joining the current session's user ID with the target resource's ownership field, ensuring that only authorized modifications are permitted regardless of the predictability of the identifier sequence. Additionally, implementing rate limiting on readthrough update requests can help mitigate automated enumeration attacks while more robust access control logic is deployed. Upgrading to a patched version where these authorization checks have been enforced is essential for restoring security posture and protecting user data integrity against unauthorized manipulation.