CyberRota Analysis
AI-GeneratedAuthenticated users of Pixelfed versions up to 0.12.9 are vulnerable due to inadequate validation of follower status in the StoryComposeController, which allows unauthorized access to follower-only stories. This flaw enables attackers to enumerate story IDs and submit reactions or comments, potentially exposing sensitive media URLs and author information. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author information without following the account.