CVE-2026-86178: Pixelfed

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author information without following the account.

Affected products

• Pixelfed Pixelfed: up to and including 0.12.9

Published 2026-09-05. Last modified 2026-09-23.