---
id: CVE-2026-86113
title: >-
  BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the
  edit_readthrough function that allows authenticated users to modify other
  users' reading records
summary: >-
  BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the
  edit_readthrough function that allows authenticated users to modify other
  users' reading records. Attackers can exploit sequential ReadThrough IDs to
  overwrite …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-639
vendor: bookwyrm-social
product: bookwyrm
affected:
  - bookwyrm <= 0.9.1
published: '2026-09-05'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:05:53.177'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86113'
references:
  - url: 'https://github.com/bookwyrm-social/bookwyrm'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/bookwyrm-social/bookwyrm/blob/v0.9.1/bookwyrm/views/status.py
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/geo-chen/oss/blob/main/bookwyrm.md#finding-3-authenticated-idor-in-edit-readthrough-allows-tampering-with-other-users-reading-progress
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/bookwyrm-through-0.9.1-insecure-direct-object-reference-in-edit-readthrough-allows-tampering-with-other-users-reading-records
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/geo-chen/oss/blob/main/bookwyrm.md#finding-3-authenticated-idor-in-edit-readthrough-allows-tampering-with-other-users-reading-progress
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00423
epssPercentile: 0.33964
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-08T13:48:54.590207Z'
ingestedAt: '2026-09-06T07:51:55.799Z'
---

## Overview

BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to modify other users' reading records. Attackers can exploit sequential ReadThrough IDs to overwrite arbitrary users' start dates, finish dates, progress, and progress mode, affecting reading statistics and exported data.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.