CVE-2026-86178
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author information without following the account.
Risk Assessment
The vulnerability compromises user privacy by allowing unauthorized access to follower-only content. This could lead to disclosure of private information and erosion of trust in the platform.
Recommendation
Update Pixelfed to the latest patched version. Also consider implementing security tests to detect similar authorization issues.
Other vulnerabilities in Pixelfed
See all- CVE-2026-93960Medium
Vulnerability in Pixelfed up to 0.12.11 affects the instancePeers function in app/Http/Controllers/Api/ApiV1Controller.php of the OAuth Scope Handler component. Manipulation of the ID argument leads to missing authentication. The attack can be remote, and the exploit is public. Upgrading to 0.12.10 is recommended (though description says 0.12.11, recommended is 0.12.10 – likely a typo).
- CVE-2026-71246Medium
Pixelfed's SearchController (behind the auth middleware) accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP against private, internal, or link-local ranges (e.g. 169.254.169.254).
Original NVD description (English source)
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author information without following the account.