Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: pixelfed Clear all filters
TI-2026-58967 CVE-2026-86178 · GHSA-cxpc-p44g-hxj7

Pixelfed through 0.12.9 Unauthorized Story Access via API

Priority LOW 24

Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0032 Published 2026-09-05 No fix listed CWE-862
TI-2026-49916 CVE-2026-71246 · GHSA-5cfc-gvxj-5r55

Pixelfed - Authenticated SSRF via Remote URL Search

Priority LOW 20

Pixelfed's SearchController (behind the auth middleware) accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0027 Published 2026-08-05 No fix listed CWE-918
TI-2025-22012 CVE-2025-30741 · GHSA-7287-grhx-542x

Incorrect authorization in Pixelfed

Priority LOW 20

Pixelfed before 0.12.5 allows anyone to follow private accounts and see private posts on other Fediverse servers.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00315 Published 2025-03-25 Fixed in 0.12.5 CWE-863
TI-2023-00866 CVE-2023-0914 · GHSA-qh6w-pq52-qxxq

Improper Authorization in pixelfed/pixelfed

Priority LOW 25

Improper Authorization in GitHub repository pixelfed/pixelfed prior to 0.11.4.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00551 Published 2023-02-19 Fixed in 0.11.4 CWE-285