CVE-2026-73211 in PeerTube
Summary
by MITRE • 08/11/2026
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including oAuthToken.accessToken, and take over administrator accounts. This issue is fixed in version 8.1.6.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
PeerTube represents a significant vulnerability within its ActivityPub federation implementation that fundamentally compromises the platform's security posture through a critical SQL injection flaw in the ActorFollowModel.updateScore() method. This vulnerability exists prior to version 8.1.6 and creates a pathway for unauthenticated remote attackers to manipulate database operations through controlled inputs from external ActivityPub servers. The core technical flaw occurs when the system interpolates an attacker-controlled inboxUrl parameter directly into SQL queries without proper sanitization or parameterization, creating an environment where malicious actors can construct arbitrary SQL commands that execute against the PeerTube database infrastructure.
The operational impact of this vulnerability extends far beyond simple data exfiltration, as it enables complete administrative takeover through database manipulation. Attackers can leverage this weakness to read sensitive authentication tokens including oAuthToken.accessToken values, which provide direct access to administrator accounts and their associated privileges. This represents a severe privilege escalation vector that transforms a remote server into an unauthorized administrator with full control over the PeerTube instance. The vulnerability affects the federated nature of PeerTube by exploiting the trust model inherent in ActivityPub protocols, where servers communicate and exchange data without sufficient verification mechanisms.
The exploitation of this vulnerability aligns with several ATT&CK techniques including T1078 Valid Accounts for maintaining persistence and T1213 Data from Information Repositories for accessing sensitive database information. From a CWE perspective, this represents a classic SQL injection vulnerability (CWE-89) that occurs due to improper input validation and sanitization of user-controlled data within database query construction processes. The flaw demonstrates poor secure coding practices where external inputs are directly concatenated into SQL statements rather than using prepared statements or parameterized queries. Organizations running PeerTube versions prior to 8.1.6 face significant risk of complete system compromise, with potential impacts including unauthorized content manipulation, user account takeover, and data breaches.
Mitigation strategies should prioritize immediate deployment of the patched version 8.1.6 which addresses the root cause through proper input sanitization and parameterized query execution. Additionally, network-level firewalls should be configured to restrict ActivityPub federation communications where possible, implementing strict access controls on the inboxUrl parameters and validating all external inputs against known good patterns. Security monitoring should be enhanced to detect unusual database access patterns or unauthorized token manipulations, while regular security audits of federated protocol implementations should be conducted to identify similar vulnerabilities in other open source projects that rely on similar communication patterns. Organizations should also consider implementing database activity monitoring solutions that can detect and alert on suspicious SQL injection attempts targeting their PeerTube instances.