{"id":"CVE-2026-86178","title":"Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories","summary":"Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reacti…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cwe":["CWE-862"],"vendor":"pixelfed","product":"pixelfed","affected":["pixelfed <= 0.12.9"],"published":"2026-09-05","updated":"2026-09-08","sourceUpdated":"2026-09-08T18:21:15.937","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86178","references":[{"url":"https://github.com/geo-chen/oss/blob/main/Pixelfed.md","label":"disclosure@vulncheck.com"},{"url":"https://github.com/pixelfed/pixelfed","label":"disclosure@vulncheck.com"},{"url":"https://github.com/pixelfed/pixelfed/blob/v0.12.9/app/Http/Controllers/StoryComposeController.php#L487-L501","label":"disclosure@vulncheck.com"},{"url":"https://github.com/pixelfed/pixelfed/blob/v0.12.9/app/Http/Controllers/StoryComposeController.php#L566-L580","label":"disclosure@vulncheck.com"},{"url":"https://github.com/pixelfed/pixelfed/blob/v0.12.9/routes/web-api.php#L154-L155","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/pixelfed-through-0.12.9-unauthorized-story-access-via-api","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-08T17:20:50.838883Z"},"epss":0.00184,"epssPercentile":0.08248,"ingestedAt":"2026-09-06T07:51:56.681Z","slug":"CVE-2026-86178","body":"## Overview\n\nPixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author information without following the account.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}