CVE-2026-86178: Pixelfed through 0.12.9 Unauthorized Story Access via API
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author information without following the account.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Pixelfed user can exploit it; the attacker does not need to follow the account whose follower-only story is targeted.
What access does an attacker need to obtain protected story information?
The attacker needs a valid authenticated account and a target story ID. Sequential story IDs can be enumerated, and the react or comment API endpoints can be used to obtain story media URLs and author information.
Are follower-only stories affected?
Yes. The affected endpoints do not validate follower status, so follower-only stories can be accessed by authenticated users who are not followers.
What information may be exposed or modified?
An attacker can retrieve story media URLs and author information. They can also submit reactions or comments through the affected endpoints.