CVE-2026-86112

Name of the Vulnerable Software and Affected Versions BookWyrm versions prior to 0.9.2

Description Authenticated attackers can favorite or unfavorite statuses that are restricted to followers-only or direct visibility due to a failure in validating user visibility permissions within the Favorite and Unfavorite views. By sending a POST request to the favorite endpoint with a specific status ID, an attacker can create unauthorized interactions, trigger ActivityPub broadcasts, and enumerate private status IDs by analyzing differences in the server responses.

Recommendations Update BookWyrm to version 0.9.2 or later.