Pixelfed
Monthly
Unauthorized story access in Pixelfed through 0.12.9 allows any authenticated user to bypass follower-gating on private stories by invoking the StoryComposeController react and comment API endpoints without a follower-relationship check. Because story IDs are sequential, an attacker can enumerate all stories on an instance and submit reactions or comments to retrieve protected media URLs and author metadata from accounts they do not follow. A public proof-of-concept is available, and no vendor-released patch has been identified at time of analysis.
Pixelfed is an open source photo sharing platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper Authorization in GitHub repository pixelfed/pixelfed prior to 0.11.4. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pixelfed/pixelfed prior to 0.11.4. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Unauthorized story access in Pixelfed through 0.12.9 allows any authenticated user to bypass follower-gating on private stories by invoking the StoryComposeController react and comment API endpoints without a follower-relationship check. Because story IDs are sequential, an attacker can enumerate all stories on an instance and submit reactions or comments to retrieve protected media URLs and author metadata from accounts they do not follow. A public proof-of-concept is available, and no vendor-released patch has been identified at time of analysis.
Pixelfed is an open source photo sharing platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper Authorization in GitHub repository pixelfed/pixelfed prior to 0.11.4. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pixelfed/pixelfed prior to 0.11.4. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.