CVE-2026-86178 in Pixelfed
Summary
by MITRE • 09/05/2026
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author information without following the account.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified in Pixelfed versions through 0.12.9 represents a critical authorization failure within the StoryComposeController component, specifically affecting the endpoints responsible for handling user interactions such as reacting to or commenting on stories. This flaw stems from an insufficient validation of follower status during API requests, allowing authenticated users to bypass access controls that are intended to restrict story visibility exclusively to followers of the account owner. In a properly secured social media application, content marked as private or restricted to followers must be verified against the relationship between the requesting user and the content author before any data is returned or actions are permitted. However, in this implementation, the server fails to enforce these checks when processing requests for story reactions or comments, creating a significant gap in access control logic that undermines the privacy expectations of users sharing sensitive personal moments.
From a technical perspective, the core issue lies in the lack of authorization middleware or explicit permission checks within the react and comment endpoints before they interact with the underlying data model representing stories. When an authenticated user submits a request to add a reaction or leave a comment on a story that is designated as follower-only, the application does not verify whether the requester actually follows the account owner. Instead, it proceeds to process the interaction if valid authentication credentials are present. This oversight allows attackers who possess legitimate accounts on the platform to exploit this logic error by targeting sequential story identifiers. By iterating through these IDs and submitting requests for reactions or comments, an attacker can trigger responses from the server that include sensitive metadata, such as direct URLs to the media files hosted within those stories and detailed information about the account author.
The operational impact of this vulnerability is substantial, particularly regarding user privacy and data confidentiality. Since Pixelfed operates on a decentralized social network model where users expect granular control over their content visibility, bypassing follower-only restrictions exposes private moments to unauthorized audiences. The ability to enumerate sequential story IDs further exacerbates the risk by enabling systematic scraping or harvesting of media assets that were never intended for public consumption. This behavior aligns with common patterns seen in broken object level authorization flaws, where attackers leverage predictable resource identifiers to access data they are not entitled to view. Consequently, users who share personal photos or videos under the assumption of privacy may find their content disseminated without consent, leading to potential reputational harm and erosion of trust in the platform's security posture.
This vulnerability maps directly to CWE-284, which describes Improper Access Control, as well as CWE-639 regarding Authorization Bypass Through User-Controlled Key, given the reliance on sequential ID enumeration for exploitation. In terms of offensive cybersecurity frameworks, this behavior is consistent with MITRE ATT&CK technique T1078, specifically Valid Accounts and potentially T1530 Data from Local System Exfiltration if used in conjunction with other tools to harvest large volumes of private media. The attack vector requires authentication but does not require high complexity or specialized privileges beyond a standard user account, making it relatively easy for malicious actors to execute at scale.
To mitigate this vulnerability, developers must implement strict authorization checks on all endpoints that interact with restricted content types like stories. Specifically, the react and comment handlers in StoryComposeController should verify the follower relationship between the authenticated requestor and the story owner before processing any action or returning data related to the media URL. This validation should occur at the service layer rather than relying solely on frontend restrictions, ensuring server-side enforcement of privacy policies regardless of client behavior. Additionally, implementing rate limiting and anomaly detection for sequential ID enumeration can help detect and block automated scraping attempts that exploit this flaw. Users are advised to update their Pixelfed instances immediately if they are running version 0.12.9 or earlier, as patching the authorization logic is essential to restoring proper access controls and protecting user privacy on decentralized social networks.