Priority HIGH 81
BookWyrm is a social network for tracking reading.
bookwyrm-social
Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
bookwyrm-social records in CISA KEVNo bookwyrm-social vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
8 records
TI-2026-58912 CVE-2026-86113 · GHSA-4p9p-pq58-9cvp
Authorization bypass in bookwyrm-social bookwyrm
Priority MEDIUM 64
BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to modify other users' reading records.
TI-2026-58910 CVE-2026-86111 · GHSA-phg3-p22v-rp9q
BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statuses
Priority MEDIUM 64
BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs.
Priority MEDIUM 64
BookWyrm is a social network for tracking your reading, talking about books, writing reviews, and discovering what to read next.
TI-2022-02451 CVE-2022-2651 · GHSA-mpr5-m5gh-62gw
Authentication Bypass by Primary Weakness in bookwyrm-social/bookwyrm
Priority MEDIUM 59
Authentication Bypass by Primary Weakness in GitHub repository bookwyrm-social/bookwyrm prior to 0.4.5.
TI-2022-07696 CVE-2022-23644
Server-side request forgery in BookWyrm
Priority MEDIUM 42
BookWyrm is a decentralized social network for tracking reading habits and reviewing books.
TI-2022-13180 CVE-2022-31136
Cross-site Scripting in BookWyrm
Priority LOW 29
Bookwyrm is an open source social reading and reviewing program.
TI-2026-58911 CVE-2026-86112 · GHSA-6779-9x55-mqpq
BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpoints
Priority LOW 24
BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access.