Read the docs
TI-2024-16563 Aliases CVE-2024-25108GHSA-gccq-h3xj-jgvf

Insufficient authorization allowing elevated access to resources in pixelfed

Priority HIGH 76CWE-280Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to access far more functionality than users intended, including to the administrative and moderator functionality of the Pixelfed server. This vulnerability affects every version of Pixelfed between v0.10.4 and v0.11.9, inclusive. A proof of concept of this vulnerability exists. This vulnerability affects every local user of a Pixelfed server, and can potentially affect the servers' ability to federate. Some user interaction is required to setup the conditions to be able to exercise the vulnerability, but the attacker could conduct this attack time-delayed manner, where user interaction is not actively required. This vulnerability has been addressed in version 0.11.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00678 52nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed pixelfed (pixelfed): 0.11.11pixelfed/pixelfed (Packagist): 0.11.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pixelfedpixelfed0.10.4 to before 0.11.110.11.11Patch availableCNA
—pixelfed/pixelfed (Packagist)0.10.4 to before 0.11.110.11.11Patch availableGHSA-gccq-h3xj-jgvf
  • pixelfed Vendorpixelfed Affected 0.10.4 to before 0.11.11 Fixed in 0.11.11 Patch available CNA
  • pixelfed/pixelfed (Packagist) Vendor— Affected 0.10.4 to before 0.11.11 Fixed in 0.11.11 Patch available GHSA-gccq-h3xj-jgvf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pixelfed:pixelfed:*:*:*:*:*:*:*:*0.10.4 to before 0.11.11Vulnerablepixelfed
  • cpe:2.3:a:pixelfed:pixelfed:*:*:*:*:*:*:*:* Versions 0.10.4 to before 0.11.11 Vulnerable ·pixelfed

Remediation

  • Fix · CNA pixelfed (pixelfed) Fixed in 0.11.11
  • Fix · GHSA-gccq-h3xj-jgvf pixelfed/pixelfed (Packagist) Fixed in 0.11.11 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-25108
  2. 2026-10-03 Alias added: GHSA-gccq-h3xj-jgvf

References

Exploit 1

Patch 1

Advisory 1

Other 3

  • TI-2023-00853 Exposure of Sensitive Information to an Unauthorized Actor in pixelfed/pixelfed CVSS 3.1MEDIUM 5.3
  • TI-2023-00866 Improper Authorization in pixelfed/pixelfed CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences