CVE-2026-93960
mediumA vulnerability was identified in Pixelfed up to 0.12.11.
A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1Controller.php of the component OAuth Scope Handler. Such manipulation of the argument ID leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and might be used. Upgrading to version 0.12.10 is recommended to address this issue. The name of the patch is 68dca5097305fa0065d029587b2233524636025a. Upgrading the affected component is advised.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/pixelfed/pixelfed/ cna@vuldb.com
- https://github.com/pixelfed/pixelfed/commit/68dca5097305fa0065d029587b2233524636025a cna@vuldb.com
- https://github.com/pixelfed/pixelfed/issues/6643 cna@vuldb.com
- https://github.com/pixelfed/pixelfed/pull/6774 cna@vuldb.com
- https://github.com/pixelfed/pixelfed/releases/tag/v0.12.10 cna@vuldb.com
- https://vuldb.com/cve/CVE-2026-93960 cna@vuldb.com
- https://vuldb.com/submit/944207 cna@vuldb.com
- https://vuldb.com/vuln/407919 cna@vuldb.com
- https://vuldb.com/vuln/407919/cti cna@vuldb.com
- https://vuldb.com/submit/944207 134c704f-9b21-4f2e-91b3-4a467353bcc0