CVE-2026-86111: Authorization Bypass Through User-Controlled Key in bookwyrm-social bookwyrm

CVE-2026-86111 describes an authorization bypass vulnerability in bookwyrm-social's BookWyrm product through version 0.9.1. The flaw exists because the status edit endpoint does not validate user visibility permissions, enabling authenticated users to enumerate sequential status IDs and access restricted followers-only and direct-message reviews. Attackers can retrieve the raw content of these statuses via the edit view, bypassing the privacy controls designed to restrict access to these message types.

The vulnerability allows authenticated attackers to read private content that should be restricted to followers or direct message recipients. This compromises user privacy by exposing sensitive reviews and messages that are intended to be confidential. There is no indication of privilege escalation or remote code execution, but the breach of confidentiality is significant.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the status edit endpoint to trusted users and monitor for suspicious enumeration of status IDs. Avoid exposing sequential identifiers or implement proper authorization checks on the server side to enforce visibility permissions.