CVE-2026-86112: BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpoints
BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create unauthorized interactions, trigger ActivityPub broadcasts, and enumerate private status IDs through response differentiation.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be authenticated to BookWyrm and able to send POST requests to the Favorite or Unfavorite endpoint. No user interaction is required.
What private content is exposed or affected?
Followers-only and direct statuses are affected when the attacker does not have permission to view them. The attacker can create or remove favorite interactions for those statuses and may enumerate private status IDs based on differences in endpoint responses.
Can exploitation have effects beyond the local BookWyrm instance?
Yes. Unauthorized favorite activity can trigger ActivityPub broadcasts, potentially propagating the interaction to federated systems.
Which versions are identified as affected?
The issue is reported in BookWyrm through version 0.9.1.