CVE-2026-86178

Name of the Vulnerable Software and Affected Versions Pixelfed versions prior to 0.12.10

Description Authenticated users can access stories restricted to followers due to a failure to validate follower status in the StoryComposeController react and comment endpoints. By enumerating sequential story IDs and submitting reactions or comments, an attacker can retrieve author information and media URLs of the stories.

Recommendations Update Pixelfed to version 0.12.10 or later. Restrict access to the StoryComposeController react and comment endpoints as a temporary mitigation measure.