Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-86178

Pixelfed through 0.12.9 Unauthorized Story Access via API

CVSS 3.1 5.4 MEDIUMCVSS 4.0 5.3 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-86178

Published

Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author information without following the account.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-86178

Published

pixelfed

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "pixelfed",
                    "product": "pixelfed",
                    "defaultStatus": "unaffected",
                    "versions": [
                        {
                            "version": "0",
                            "lessThanOrEqual": "0.12.9",
                            "status": "affected",
                            "versionType": "semver"
                        }
                    ],
                    "packageURL": "pkg:github/pixelfed/pixelfed"
                }

Original source record · Cite this exact observation · Complete original publisher JSON