GHSA-6779-9x55-mqpqMediumCVSS 5.4
BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and...
🔗 CVE IDs covered (1)
📋 Description
BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create unauthorized interactions, trigger ActivityPub broadcasts, and enumerate private status IDs through response differentiation.
🔗 References (6)
- https://nvd.nist.gov/vuln/detail/CVE-2026-86112
- https://github.com/bookwyrm-social/bookwyrm
- https://github.com/bookwyrm-social/bookwyrm/blob/v0.9.1/bookwyrm/views/interaction.py
- https://github.com/geo-chen/oss/blob/main/bookwyrm.md#finding-2-authenticated-idor-in-favoriteunfavorite-allows-interaction-with-private-statuses
- https://www.vulncheck.com/advisories/bookwyrm-through-0.9.1-missing-authorization-on-the-favorite-and-unfavorite-endpoints
- https://github.com/advisories/GHSA-6779-9x55-mqpq