CyberRota Analysis
AI-GeneratedThe vulnerability allows unauthenticated remote servers to manipulate SQL queries due to improper handling of the ActivityPub actor inboxUrl in PeerTube versions prior to 8.1.6. This can lead to unauthorized access to the database, including sensitive data such as administrator access tokens, potentially resulting in account takeovers. Organizations using PeerTube should prioritize upgrading to version 8.1.6 or later to mitigate this critical risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including oAuthToken.accessToken, and take over administrator accounts. This issue is fixed in version 8.1.6.