CVE-2026-86178

EUVD-2026-71977
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author information without following the account.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
pixelfedpixelfed
𝑥
≤ 0.12.9
CNA
Common Weakness Enumeration
References
https://github.com/geo-chen/oss/blob/main/Pixelfed.md
https://github.com/pixelfed/pixelfed
https://github.com/pixelfed/pixelfed/blob/v0.12.9/app/Http/Controllers/StoryComposeController.php#L487-L501
https://github.com/pixelfed/pixelfed/blob/v0.12.9/app/Http/Controllers/StoryComposeController.php#L566-L580
https://github.com/pixelfed/pixelfed/blob/v0.12.9/routes/web-api.php#L154-L155
https://www.vulncheck.com/advisories/pixelfed-through-0.12.9-unauthorized-story-access-via-api