Vulnerabilidades do Pixelfed Pixelfed

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Pixelfed Pixelfed: 1 registro(s), com versões afetadas e correções.

CVE-2026-86178 Média · 5.4 CWE-862 05/09/2026

Pixelfed through 0.12.9 Unauthorized Story Access via API

Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author information without following the account.