Quick answers
- Is CVE-2026-86111 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-86111 being exploited in the wild.
- How severe is CVE-2026-86111?
- Medium severity, with a CVSS score of 6.5, published 5 September 2026.
- Which products and versions are affected?
- BookWyrm through 0.9.1.
- Is there a fix for CVE-2026-86111?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-86111 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-86111?
- Check whether you run BookWyrm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
BookWyrm's status edit endpoint fails to properly validate user visibility permissions, allowing authenticated attackers to enumerate and read restricted status objects by sequentially testing status IDs. The vulnerability affects followers-only and direct-message reviews, which should be hidden from unauthorized users but are accessible via the edit view without proper authorization checks. Attack requires valid user authentication but no special privileges; an attacker can systematically probe for and retrieve raw content of restricted statuses by incrementing ID values. The flaw allows complete circumvention of the documented privacy protections for these message types, exposing sensitive user communication. The vulnerability is present through version 0.9.1; patches or mitigations in later versions should be verified.
Affected products
- BookWyrm BookWyrm through 0.9.1
Timeline
- 2026-09-05: disclosed