CVE-2026-86112: Authorization Bypass Through User-Controlled Key in bookwyrm-social bookwyrm

CVE-2026-86112 describes an authorization bypass in BookWyrm through version 0.9.1. The application fails to validate user visibility permissions when processing favorite and unfavorite actions. Attackers with authentication can POST to the favorite endpoint using a status ID they should not access, allowing them to create unauthorized favorites or unfavorites on followers-only and direct statuses. This flaw also permits enumeration of private status IDs by analyzing response variations and causes unintended ActivityPub broadcasts.

The vulnerability allows authenticated users to interact with private statuses they are not authorized to access, potentially exposing private information and user interactions. It also enables enumeration of private status IDs, which could aid further targeted attacks or privacy violations. The unauthorized ActivityPub broadcasts may lead to unintended information disclosure within federated networks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the favorite/unfavorite endpoints to trusted users and monitor for suspicious activity involving these endpoints. Avoid exposing status IDs in unprotected contexts.