EUVD-2026-56786Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote server reaches the injectable query via default federation (AV:N/AC:L/PR:N/UI:N); arbitrary DB read/write and admin takeover yield C:H/I:H/A:H.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including oAuthToken.accessToken, and take over administrator accounts. This issue is fixed in version 8.1.6.
AnalysisAI
SQL injection in PeerTube's federation layer (versions prior to 8.1.6) lets an unauthenticated remote ActivityPub server read and write arbitrary database tables and seize administrator accounts. The flaw lives in ActorFollowModel.updateScore(), where an attacker-controlled actor inboxUrl is string-interpolated directly into an UPDATE statement; by exfiltrating oAuthToken.accessToken values an attacker can impersonate admins. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target PeerTube instance (< 8.1.6) accept ActivityPub federation from the attacker's server and process a follow interaction so that ActorFollowModel.updateScore() runs against the attacker-controlled actor inboxUrl - the injection point is the inboxUrl/sharedInboxUrl value carried in federation metadata. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue, not a paper-tiger high CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker stands up a malicious ActivityPub server and initiates a federation follow toward a target PeerTube instance, presenting an actor whose inboxUrl contains a crafted SQL payload. When PeerTube recalculates the follow score, the payload executes inside the UPDATE query, letting the attacker read oAuthToken.accessToken and hijack an administrator session. … |
| Remediation | Vendor-released patch: 8.1.6 - upgrade PeerTube to v8.1.6 or later (a subsequent v8.1.8 release also exists: https://github.com/Chocobozzz/PeerTube/releases/tag/v8.1.6). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all PeerTube instances and identify those running versions earlier than 8.1.6. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today