Pixelfed Story Media Exposure via Follower Check Bypass

Executive Summary

CVE-2026-86178 is a missing authorization vulnerability in Pixelfed through version 0.12.9. It affects the StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories without proper checks. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author information without following the account.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor API requests to Pixelfed's story endpoints for unauthorized reactions or comments. Check logs for sequential story ID enumeration attempts or requests to /api/v1/stories/{id}/react or /api/v1/stories/{id}/comment without proper authorization headers. Use network traffic analysis tools like Wireshark or tcpdump to inspect HTTP POST requests to these endpoints.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to view private stories, obtain media URLs, and force unsolicited notifications to victims. It can lead to privacy violations, unauthorized access to sensitive data, and potential harassment through forced notifications. Low-privilege attackers can perform unauthorized actions and leak information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR by exposing private user data without consent and HIPAA by potentially leaking sensitive health-related media. It undermines data protection requirements for confidentiality and access controls, risking non-compliance with privacy regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Pixelfed to the latest version beyond 0.12.9. Implement strict authorization checks in StoryComposeController to verify follower status before allowing reactions or comments. Add input validation to prevent sequential ID enumeration and restrict API access to authenticated users only. Review logs for past unauthorized access attempts.

Useful 0 Not Useful 0