Description
BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create unauthorized interactions, trigger ActivityPub broadcasts, and enumerate private status IDs through response differentiation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| bookwyrm-social | bookwyrm | ≤ 0.9.1 | — |
References
- Researcher write-up: finding 2 technical-description
- Favorite/Unfavorite fetch by id with no visibility check technical-description
- https://github.com/bookwyrm-social/bookwyrm product
- VulnCheck Advisory: BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpoints third-party-advisory