Description

Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author information without following the account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-05T11:16:46.537Z",
  "pubdate": "2026-09-05T11:16:46.537Z",
  "executiveSummary": "Pixelfed versions through 0.12.9 contain a critical access control vulnerability within the StoryComposeController react and comment endpoints. This flaw stems from a failure to perform server-side validation of user follow status, allowing authenticated users to bypass visibility restrictions set by content creators.\nThe vulnerability allows unauthorized actors to access 'follower-only' stories by interacting with sequential story IDs. By submitting crafted requests to the impacted endpoints, attackers can force the application to disclose sensitive metadata, including media URLs and author identity, even when they do not possess the required follower relationship.\nThe risk implication is significant as it facilitates unauthorized data exposure and information gathering, undermining the privacy controls inherent to the platform's social model. Exploitation requires an authenticated Pixelfed account and basic knowledge of the application's sequential identifier patterns. No elevated privileges are required, making this an accessible vector for attackers aiming to scrape protected private content or perform reconnaissance on user interactions.",
  "technicalDetails": "The root cause of this vulnerability lies in an insufficient implementation of authorization checks within the StoryComposeController react and comment endpoints. Specifically, the application logic assumes that the requesting user has already met the necessary visibility criteria—or fails to verify them entirely—before processing interactions with story content.\nThe vulnerability manifests due to the predictable nature of resource identifiers and the lack of server-side validation of the follower relationship between the requesting user and the story author. Because the backend fails to validate that the `authenticated_user_id` is present in the `author_id`'s follower list before executing the requested action, the system inadvertently treats all authenticated users as authorized viewers.\nThe attack flow proceeds as follows: First, an attacker authenticates to the Pixelfed instance. Second, the attacker leverages the predictable structure of sequential story IDs to systematically enumerate target resources. Third, for each enumerated ID, the attacker submits an API request to the StoryComposeController react or comment endpoints. Because these endpoints do not enforce access control policy, the application processes the request and returns the associated response.\nThe response payloads from these endpoints include highly sensitive data, such as authenticated media URLs (which may be hosted on private storage buckets) and detailed author information. Even if the attacker does not intend to post a legitimate comment or reaction, the mere act of submitting the request triggers the disclosure of internal resource identifiers and metadata.\nThe affected component, StoryComposeController, serves as a primary interface for user engagement with the Stories feature. Versions affected include all releases up to and including 0.12.9. As the vulnerability is located at the API layer, it is exposed to any authenticated user with network access to the application, regardless of their specific role or administrative standing.\nPost-exploitation, an attacker can automate the harvesting of private story media and construct a comprehensive profile of a target user's private social graph and media history. This unauthorized data extraction bypasses the intended privacy boundary of the platform, potentially exposing non-public multimedia assets and user relationships to malicious actors."
}