---
id: CVE-2026-73211
title: PeerTube is an ActivityPub-federated video streaming platform
summary: >-
  PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6,
  ActorFollowModel.updateScore() interpolates the attacker-controlled
  ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated
  remote server to…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-89
published: '2026-08-11'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T20:46:02.457'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73211'
references:
  - url: >-
      https://github.com/Chocobozzz/PeerTube/commit/cc07364a5d635b6e43a92fc5e2e2e3eeacf4e8f4
    label: security-advisories@github.com
  - url: 'https://github.com/Chocobozzz/PeerTube/releases/tag/v8.1.6'
    label: security-advisories@github.com
  - url: 'https://github.com/Chocobozzz/PeerTube/releases/tag/v8.1.8'
    label: security-advisories@github.com
  - url: >-
      https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-pqr4-34h8-g39x
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00726
epssPercentile: 0.5213
ingestedAt: '2026-09-09T21:22:45.528Z'
---

## Overview

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including oAuthToken.accessToken, and take over administrator accounts. This issue is fixed in version 8.1.6.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.