CVE-2026-86111

BookWyrm through version 0.9.1 contains an Insecure Direct Object Reference (IDOR) in the status edit endpoint. The root cause is a failure to validate user visibility permissions, allowing any authenticated attacker to read followers-only and direct-message reviews by enumerating sequential stat...