CVE-2026-86111: BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statuses
BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit view, bypassing the privacy protections documented for these message types.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated BookWyrm user can exploit it. The attacker does not need interaction from the status author, but does need to enumerate status IDs and access the status edit endpoint.
What information can be exposed?
The issue exposes the raw content of followers-only statuses and direct-message reviews. It bypasses the visibility protections intended for those restricted status types.
Which deployments are affected?
BookWyrm versions through 0.9.1 are affected. The provided information does not identify a configuration prerequisite, so deployments using the affected status edit functionality should be treated as exposed.
How can an administrator determine whether private statuses may have been accessed?
Review access logs for authenticated requests to the status edit endpoint, especially requests for sequential status IDs that do not belong to the requesting user or are not visible to them. The provided information does not specify endpoint paths or logging fields.