CVE-2026-86113 bookwyrm-social CVE debrief

Who should care

Defenders responsible for BookWyrm deployments, particularly those with user authentication and reading record functionality, should assess exposure and prioritize verification of user authentication and authorization.

Why it matters

CVE-2026-86113 is an authorization bypass vulnerability in BookWyrm through 0.9.1. Defenders should prioritize verifying user authentication and authorization for reading records, and consider implementing additional access controls to prevent unauthorized modifications.

• Potential tampering with reading statistics and exported data
• Need to verify user authentication and authorization for reading records
• Possible impact on user reading progress and progress mode

Technical summary

The edit_readthrough function in BookWyrm through 0.9.1 contains an authorization bypass vulnerability. This allows authenticated users to modify other users' reading records by exploiting sequential ReadThrough IDs. The vulnerability affects reading statistics and exported data. Defenders should prioritize verifying user authentication and authorization for reading records and consider implementing additional access controls to prevent unauthorized modifications. The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions or remediation is limited. The vulnerability was reported in BookWyrm version 0.9.1, and defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Monitoring, detection, and logs for exposed assets should be checked for extra review. Exceptions, retested remediated assets, and closed items should be tracked only after evidence is documented. The vulnerability has a CVSS score of 7.1 and is considered HIGH severity. The CVE record was published on 2026-09-05T10:16:42.273Z and has not been modified since then. The NVD entry and CVE Program record provide additional context on the vulnerability. The edit_readthrough function's authorization bypass allows attackers to overwrite arbitrary users' start dates, finish dates, progress, and progress mode. This could lead to potential tampering with reading statistics and exported data. Defenders responsible for BookWyrm deployments, particularly those with user authentication and reading record functionality, should assess exposure and prioritize verification of user authentication and authorization. Additional access controls should be considered to prevent unauthorized modifications. The vulnerability's impact on user reading progress and progress mode should be evaluated. The BookWyrm version 0.9.1 is specifically affected, and defenders should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Compensating controls for 7

Defensive priority

Defenders should prioritize verifying user authentication and authorization for reading records, and consider implementing additional access controls.

Recommended defensive actions

• Verify user authentication and authorization for reading records
• Implement additional access controls to prevent unauthorized modifications
• Monitor reading statistics and exported data for potential tampering
• Review compensating controls for exposed systems while remediation is scheduled
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability was reported in BookWyrm version 0.9.1. The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions or remediation is limited. Evidence is based on CVE and NVD data. Defenders should verify user authentication and authorization for reading records, review official advisories, and assess exposure. Limited information is available on affected versions beyond 0.9.1. Compensating controls and monitoring may be necessary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.