Executive brief
BookWyrm is a social platform for sharing book reviews and ratings. Attackers with user accounts can bypass privacy controls to read restricted reviews (marked as followers-only or direct messages) by directly accessing the edit endpoint with sequential status IDs, exposing private content intended only for specific audiences.
Technical details
BookWyrm's status edit endpoint fails to properly validate user visibility permissions, allowing authenticated attackers to enumerate and read restricted status objects by sequentially testing status IDs. The vulnerability affects followers-only and direct-message reviews, which should be hidden from unauthorized users but are accessible via the edit view without proper authorization checks. Attack requires valid user authentication but no special privileges; an attacker can systematically probe for and retrieve raw content of restricted statuses by incrementing ID values. The flaw allows complete circumvention of the documented privacy protections for these message types, exposing sensitive user communication. The vulnerability is present through version 0.9.1; patches or mitigations in later versions should be verified.
Affected products
- BookWyrm BookWyrm through 0.9.1
Timeline
- 2026-09-05: disclosed