CVE-2026-86178

    Dashboard / Vulnerabilities / CVE-2026-86178

    CVE-2026-86178

    Published: 5 Sept 2026Last Modified: 25 Sept 2026

    Summary: Pixelfed through 0.12.9 Unauthorized Story Access via API

    Details: Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author information without following the account.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86178.json, https://nvd.nist.gov/vuln/detail/CVE-2026-86178, https://www.vulncheck.com/advisories/pixelfed-through-0.12.9-unauthorized-story-access-via-api, https://github.com/pixelfed/pixelfed, https://github.com/pixelfed/pixelfed/blob/v0.12.9/app/Http/Controllers/StoryComposeController.php#L487-L501, https://github.com/pixelfed/pixelfed/blob/v0.12.9/app/Http/Controllers/StoryComposeController.php#L566-L580, https://github.com/pixelfed/pixelfed/blob/v0.12.9/routes/web-api.php#L154-L155, https://github.com/geo-chen/oss/blob/main/Pixelfed.md

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -0dc12f23edda47b9e6336c3b1d85687442225055

    Affected versions

    v0.12.8
    v0.12.7
    v0.12.6
    v0.12.5
    v0.12.4
    v0.12.3
    v0.12.2
    v0.12.1
    v0.12.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-86178 | CVE-DB