CVE-2026-86112

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create...

CVE-2026-86112 BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpoints

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create...

CVE-2026-86112

BookWyrm through version 0.9.1 contains an authorization flaw in its Favorite and Unfavorite views (located in interaction.py). The endpoint fails to validate user visibility permissions, allowing authenticated attackers to POST a status ID to the favorite endpoint and create unauthorized interac...

CVE-2026-86112 BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpoints

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create...

CVE-2026-86112: Authorization Bypass Through User-Controlled Key

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create...