Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to… (CVE-2026-86178)
Description
Pixelfed versions through 0.12.9 contain a vulnerability in the StoryComposeController react and comment endpoints where follower status is not properly validated. This flaw allows authenticated users to interact with follower-only stories by enumerating story IDs and submitting reactions or comments, thereby accessing story media URLs and author information without following the account. The vulnerability has a CVSS 3.1 score of 5.4, indicating medium severity.
CVSS v3.1
Score 5.4medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Pixelfed through version 0.12.9 fails to validate follower status in the StoryComposeController react and comment endpoints. Authenticated users can exploit this by enumerating sequential story IDs and submitting reactions or comments to follower-only stories, which should be restricted. This leads to unauthorized access to story media URLs and author information. The issue is classified under CWE-862 (Missing Authorization). No patch or remediation information is provided in the source data.
Potential Impact
Authenticated users can bypass follower-only restrictions to access media URLs and author information of stories they do not follow. This results in unauthorized disclosure of potentially private content. There is no indication of impact on system integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user access to the StoryComposeController react and comment endpoints or implement additional access controls to enforce follower status validation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-cxpc-p44g-hxj7
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-86178"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a9c2576acd9273b49fa7f5e
Added to database: 09/05/2026, 14:21:42 UTC
Last enriched: 09/07/2026, 15:10:49 UTC
Last updated: 10/19/2026, 06:48:20 UTC
Views: 43
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.