CVE-2026-86113

Name of the Vulnerable Software and Affected Versions BookWyrm versions prior to 0.9.2

Description An authorization bypass exists in the edit readthrough() function. Authenticated users can exploit sequential ReadThrough IDs to modify reading records belonging to other users. This allows the unauthorized overwriting of start dates, finish dates, progress, and progress mode, which impacts reading statistics and exported data.

Recommendations Update BookWyrm to version 0.9.2 or later. As a temporary workaround, restrict access to the edit readthrough() function to minimize the risk of exploitation.