Description

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create unauthorized interactions, trigger ActivityPub broadcasts, and enumerate private status IDs through response differentiation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-05T10:16:42.130Z",
  "pubdate": "2026-09-05T10:16:42.130Z",
  "executiveSummary": "BookWyrm through version 0.9.1 contains a broken access control vulnerability within its Favorite and Unfavorite functional components. This flaw allows an authenticated attacker to perform unauthorized interactions with statuses that are restricted by privacy settings, specifically those limited to followers-only or direct messaging scopes.\nThe vulnerability stems from a failure to perform server-side permission validation during the execution of favorite and unfavorite operations. By submitting specifically crafted POST requests containing targeted status IDs, an attacker can bypass intended access restrictions.\nThe impact includes the ability for unauthorized users to interact with private content, trigger unintended ActivityPub broadcast notifications to status owners, and conduct enumeration attacks to identify the existence or valid IDs of private statuses based on server response differentiation. The vulnerability requires the attacker to be an authenticated user within the target instance but does not require any additional administrative or escalated privileges, representing a significant risk to user data confidentiality and platform integrity.",
  "technicalDetails": "The root cause of this vulnerability is the absence of adequate authorization checks within the application's controller logic responsible for handling 'Favorite' and 'Unfavorite' actions. In BookWyrm versions 0.9.1 and earlier, the system fails to verify whether the authenticated user possesses the necessary permissions to access, view, or interact with a specific status ID before processing the request.\nThe exploitation flow initiates when an authenticated attacker transmits a POST request to the application's favorite or unfavorite endpoints. The payload of this request includes the unique identifier of a status that should be inaccessible to the attacker due to the status's visibility settings (e.g., 'followers-only' or 'direct'). Because the application does not validate the relationship between the authenticated user and the target status owner, or the visibility attribute of the status itself, the backend proceeds to commit the requested action to the database.\nThis behavior facilitates several critical security failures. First, it allows for unauthorized interaction, which may trigger downstream ActivityPub 'Like' activities. When the server processes an unauthorized favorite action, it may broadcast these activities to federated instances, potentially exposing the existence of private statuses to third-party servers or unauthorized users. Second, the vulnerability enables an enumeration attack. By observing variations in HTTP response codes (e.g., distinguishing between a successful 200 OK for a valid status ID versus a 404 Not Found for a non-existent one), an attacker can systematically scan and map the private status identifiers present within the database, even if they cannot retrieve the full content of those statuses.\nThe vulnerability resides in the application’s request handling layer, specifically in the logic governing how the system confirms authorization prior to executing state-changing operations on status objects. Since ActivityPub protocols rely on distributed messaging, the unauthorized broadcast of these interactions further compounds the impact, as it facilitates unauthorized metadata disclosure across the decentralized social network. Exploitation is trivial, requiring only an authenticated session and the ability to guess or identify target status IDs, which is facilitated by the observed response differentiation."
}