Read the docs

pixelfed

Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

pixelfed records in CISA KEV

No pixelfed vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Pixelfed 3 records HIGH

Records

6 records

TI-2023-00866 CVE-2023-0914 · GHSA-qh6w-pq52-qxxq

Improper Authorization in pixelfed/pixelfed

Priority LOW 25

Improper Authorization in GitHub repository pixelfed/pixelfed prior to 0.11.4.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00551 Published 2023-02-19 Fixed in 0.11.4 CWE-285
TI-2026-58967 CVE-2026-86178 · GHSA-cxpc-p44g-hxj7

Pixelfed through 0.12.9 Unauthorized Story Access via API

Priority LOW 24

Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0032 Published 2026-09-05 No fix listed CWE-862
TI-2026-49916 CVE-2026-71246 · GHSA-5cfc-gvxj-5r55

Pixelfed - Authenticated SSRF via Remote URL Search

Priority LOW 20

Pixelfed's SearchController (behind the auth middleware) accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0027 Published 2026-08-05 No fix listed CWE-918
TI-2025-22012 CVE-2025-30741 · GHSA-7287-grhx-542x

Incorrect authorization in Pixelfed

Priority LOW 20

Pixelfed before 0.12.5 allows anyone to follow private accounts and see private posts on other Fediverse servers.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00315 Published 2025-03-25 Fixed in 0.12.5 CWE-863
Open these records in search →