CVE-2026-86111

CVE-2026-86111 is an authorization bypass (CWE-639) in BookWyrm's status edit endpoint, which through version 0.9.1 fails to check that the requesting user is allowed to view a status before serving it. An authenticated user on the same instance can iterate over sequential numeric status IDs and request the edit view, retrieving the raw content of statuses they cannot normally see. This leaks followers-only posts and direct-message reviews - content BookWyrm documents as private - to any registered account, producing a high-impact confidentiality-only issue (CVSS 4.0 7.1, VC:H, no integrity or availability impact). All instances running BookWyrm 0.9.1 or earlier are affected; exposure is limited to servers where the attacker holds an account, since authentication is required. No public proof-of-concept, KEV listing, or known exploitation exists, and EPSS assigns a 0.3% probability of exploitation in the next 30 days (16th percentile).

What to do: Upgrade BookWyrm to a release newer than 0.9.1 as soon as a patched version is available, and verify the fix returns non-visible statuses for unauthorized edit-view requests. Until patching, enable invite-only or approval-based registration and audit logs for authenticated accounts systematically requesting sequential status edit endpoints. Because exploitation requires a local account, removing dormant accounts and reviewing who can register reduces exposure.