THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-86111 (MEDIUM 6.5) — BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses t

[NVD] CVE-2026-86111 (MEDIUM 6.5) — BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses t

mednvdPublished 2026-09-05

CVE-2026-86111 CVSS: 6.5 MEDIUM Published: 2026-09-05T10:16:40.963

BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit view, bypassing the privacy protecti

Indicators of compromise

CVE-2026-86111cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-86111