CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated attackers to manipulate the Favorite and Unfavorite functionalities in BookWyrm versions up to 0.9.1, enabling them to interact with followers-only and direct statuses that should be inaccessible. This can lead to unauthorized interactions, potential exposure of private status IDs, and unwanted ActivityPub broadcasts. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized data exposure and interaction.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create unauthorized interactions, trigger ActivityPub broadcasts, and enumerate private status IDs through response differentiation.