CVE-2026-86111

Name of the Vulnerable Software and Affected Versions BookWyrm versions prior to 0.9.2

Description Authenticated attackers can read restricted reviews, including those set to followers-only or direct-message, by enumerating sequential status IDs. This occurs because the software fails to validate user visibility permissions at the status edit endpoint. By accessing the edit view, attackers can bypass privacy protections and read the raw content of these restricted statuses.

Recommendations Update BookWyrm to version 0.9.2 or later.