Vulnerabilidades de Pixelfed
CVEs publicadas que afetam produtos de Pixelfed: 1 registro(s), com severidade, exploração e correções.
CVE-2026-86178
Média · 5.4
CWE-862 05/09/2026
Pixelfed through 0.12.9 Unauthorized Story Access via API
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author information without following the account.