Vulnerability Description
BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to modify other users' reading records. Attackers can exploit sequential ReadThrough IDs to overwrite arbitrary users' start dates, finish dates, progress, and progress mode, affecting reading statistics and exported data.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/bookwyrm-social/bookwyrm
- https://github.com/bookwyrm-social/bookwyrm/blob/v0.9.1/bookwyrm/views/status.py
- https://github.com/geo-chen/oss/blob/main/bookwyrm.md#finding-3-authenticated-id
- https://www.vulncheck.com/advisories/bookwyrm-through-0.9.1-insecure-direct-obje
- https://github.com/geo-chen/oss/blob/main/bookwyrm.md#finding-3-authenticated-id
FAQ
What is CVE-2026-86113?
CVE-2026-86113 is a vulnerability with a CVSS score of 6.5 (MEDIUM). BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to modify other users' reading records. Attackers can exploit seq...
How severe is CVE-2026-86113?
CVE-2026-86113 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-86113?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.