Description

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including oAuthToken.accessToken, and take over administrator accounts. This issue is fixed in version 8.1.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-11T18:18:26.357Z",
  "pubdate": "2026-08-11T18:18:26.357Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in PeerTube prior to version 8.1.6, specifically within the ActorFollowModel.updateScore() function.\nThe vulnerability allows an unauthenticated remote server participating in the ActivityPub federation to execute arbitrary SQL queries against the underlying database.\nThe primary impact of this security flaw includes unauthorized read and write access to sensitive PeerTube database tables, such as oAuthToken.accessToken, potentially leading to a complete administrative account takeover.\nThe flaw stems from the insecure interpolation of attacker-controlled ActivityPub actor inboxUrl parameters directly into database query strings.\nExploitation requires network exposure via the ActivityPub federation protocol, but does not require prior authentication or privileged access from the remote attacker.\nThe high severity risk implications require immediate remediation to prevent full database compromise and unauthorized administrative access.",
  "technicalDetails": "The root cause of the vulnerability resides in the ActorFollowModel.updateScore() function within the PeerTube codebase.\nDuring the processing of ActivityPub protocol interactions, the application extracts the actor inboxUrl parameter, which is entirely attacker-controlled when received from a malicious or compromised remote federated server.\nInstead of utilizing parameterized queries or safe abstraction layers provided by the Object-Relational Mapping (ORM) or query builder, the vulnerable function directly interpolates the inboxUrl string into the SQL query construction.\nThis improper neutralization of special elements allows an attacker to break out of the intended SQL query context and inject arbitrary SQL commands.\nThe attack flow begins when an unauthenticated remote server sends a crafted ActivityPub request containing malicious payloads within the inboxUrl attribute to a vulnerable PeerTube instance.\nThe PeerTube instance processes the incoming federation payload and passes the unvalidated inboxUrl value to the ActorFollowModel.updateScore() method.\nThe resulting constructed SQL query is then executed against the database with the privileges of the database user associated with the PeerTube application.\nDue to the database access capabilities granted by SQL injection, attackers can read arbitrary database contents and perform write operations.\nSpecifically, post-exploitation impact includes the extraction and manipulation of sensitive tokens stored in the oAuthToken.accessToken table.\nBy modifying or forging authentication tokens, an unauthenticated remote attacker can successfully authenticate as an administrator, resulting in a complete administrative account takeover of the affected PeerTube instance.\nThe vulnerability affects PeerTube versions prior to 8.1.6, requires network exposure via ActivityPub protocols, and demands no authentication or privileges."
}