Description

BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to modify other users' reading records. Attackers can exploit sequential ReadThrough IDs to overwrite arbitrary users' start dates, finish dates, progress, and progress mode, affecting reading statistics and exported data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-05T10:16:42.273Z",
  "pubdate": "2026-09-05T10:16:42.273Z",
  "executiveSummary": "BookWyrm versions through 0.9.1 are susceptible to an Insecure Direct Object Reference (IDOR) vulnerability resulting in an authorization bypass.\nThis flaw resides within the edit_readthrough function, allowing authenticated users to manipulate reading records belonging to other users.\nThe vulnerability allows an attacker to modify sensitive data, including start dates, finish dates, progress, and progress mode settings, without requiring elevated permissions or administrative access.\nBy iterating through sequential ReadThrough ID values, a malicious actor can systematically overwrite the reading histories of arbitrary users.\nThe impact includes the corruption of user-specific reading statistics and the potential for tampering with exported user data.\nThis vulnerability poses a significant risk to data integrity and user privacy, as the platform fails to enforce proper ownership verification checks before processing update requests.\nExploitation requires the attacker to hold an authenticated account on the target instance but does not require administrative privileges.",
  "technicalDetails": "The vulnerability is classified as an Insecure Direct Object Reference (IDOR) occurring within the application's business logic for managing user reading progress. The root cause is the failure of the edit_readthrough function to perform server-side authorization checks to verify that the authenticated user owns the ReadThrough object being modified.\nIn the affected versions of BookWyrm, the application uses sequential integer-based identifiers for ReadThrough records. When a user initiates a request to update their reading status, the application expects an identifier corresponding to the specific record in the database. Because the edit_readthrough function does not validate that the current session user ID matches the owner ID associated with the provided ReadThrough ID, the application processes the update request regardless of the requester's actual ownership of the target resource.\nThe attack flow proceeds as follows: First, an attacker authenticates to the BookWyrm instance to obtain a valid session. Second, the attacker targets a specific ReadThrough ID or iterates through a range of sequential IDs. Third, the attacker sends a crafted POST or PUT request to the edit_readthrough endpoint, including the chosen ReadThrough ID and manipulated parameters for start dates, finish dates, reading progress, or progress mode. Finally, the server updates the database entry for the target user's record without validating the relationship between the session user and the record.\nThis behavior allows an attacker to perform unauthorized state changes on any reading record identified by the system. The payload involves passing legitimate schema data to the endpoint while targeting unauthorized record identifiers. Successful exploitation results in the permanent alteration of reading metrics, which may affect the integrity of statistics tracked by individual users and downstream data exports. Since the identifier scheme is predictable due to its sequential nature, the effort required to enumerate valid records is minimal, increasing the overall risk of widespread data manipulation across the platform instance."
}