CVE-2026-73211
CriticalCVSS 9.8Summary
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including oAuthToken.accessToken, and take over administrator accounts. This issue is fixed in version 8.1.6.
Risk Assessment
The risk includes full compromise of a PeerTube instance, including administrator accounts and access to sensitive data, potentially leading to severe security breaches.
Recommendation
It is recommended to immediately update PeerTube to version 8.1.6 or later and implement input validation in SQL queries.
Original NVD description (English source)
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including oAuthToken.accessToken, and take over administrator accounts. This issue is fixed in version 8.1.6.