MEDIUM 5.3 NVD
CVE-2026-86178
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author information without following the account.
References
- https://github.com/geo-chen/oss/blob/main/Pixelfed.md
- https://github.com/pixelfed/pixelfed
- https://github.com/pixelfed/pixelfed/blob/v0.12.9/app/Http/Controllers/StoryComposeControl
- https://github.com/pixelfed/pixelfed/blob/v0.12.9/app/Http/Controllers/StoryComposeControl
- https://github.com/pixelfed/pixelfed/blob/v0.12.9/routes/web-api.php#L154-L155
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-09-05 via NVD.
vulnfeed aggregates 10223 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.