Beveiligingsadvies

CVE-2026-86112

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-09-05 09:59:04

Laatst bijgewerkt 2026-09-05 09:59:04

Toegewezen door VulnCheck

CVSS-score 5.4

Status PUBLISHED

Beschrijving

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create unauthorized interactions, trigger ActivityPub broadcasts, and enumerate private status IDs through response differentiation.

← Alle CVE's bekijken Bekijk op cve.org ↗