Description
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author information without following the account.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pixelfed | pixelfed | ≤ 0.12.9 | — |
References
- Researcher Advisory third-party-advisory exploit
- StoryComposeController react technical-description
- StoryComposeController comment technical-description
- Story react and comment routes technical-description
- https://github.com/pixelfed/pixelfed product
- VulnCheck Advisory: Pixelfed through 0.12.9 Unauthorized Story Access via API third-party-advisory