CVE-2026-86113

BookWyrm through 0.9.1 contains an authorization bypass (CWE-639) in the edit_readthrough function, which fails to verify that a ReadThrough record belongs to the requesting user, making the numeric record ID the only access control. An attacker with any authenticated account on an instance sends an edit request referencing another user's ReadThrough ID; because IDs are sequential and predictable, they can iterate through records belonging to arbitrary users. The attacker gains the ability to overwrite other users' start dates, finish dates, progress values, and progress mode, corrupting those users' reading statistics and exported data, though there is no confidentiality impact, code execution, or privilege escalation. Affected parties are operators and users of BookWyrm instances running version 0.9.1 or earlier, with the greatest impact on multi-user instances since single-user instances have no other users' records to tamper with. No public proof-of-concept, no listing in CISA KEV, and an EPSS of 0.2% indicate no known exploitation at this time.

What to do: Upgrade instances to the first patched release after 0.9.1 as soon as one is published, or apply the upstream ownership-check fix to edit_readthrough. Until patched, on multi-user instances consider restricting write access to ReadThrough endpoints and review logs and exports for unexpected changes to users' start/finish dates and progress fields.