Description

A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1Controller.php of the component OAuth Scope Handler. Such manipulation of the argument ID leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and might be used. Upgrading to version 0.12.10 is recommended to address this issue. The name of the patch is 68dca5097305fa0065d029587b2233524636025a. Upgrading the affected component is advised.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-20T04:17:55.540Z",
  "pubdate": "2026-09-20T04:17:55.540Z",
  "executiveSummary": "A critical authentication bypass vulnerability has been identified in Pixelfed versions up to 0.12.11, specifically within the OAuth Scope Handler component.\nThe vulnerability resides in the instancePeers function of the app/Http/Controllers/Api/ApiV1Controller.php file, where improper handling of the ID argument allows unauthorized access to protected API resources.\nThis flaw permits remote attackers to circumvent authentication controls, potentially exposing sensitive instance information or performing actions on behalf of the application without valid credentials.\nGiven that exploit code is publicly available, the risk of active exploitation is significant, necessitating immediate administrative intervention.\nThe vulnerability represents a failure in the application's access control logic, undermining the integrity and privacy of the Pixelfed instance. Affected systems are urged to upgrade to the recommended version to mitigate unauthorized data access risks.",
  "technicalDetails": "The vulnerability originates from inadequate input validation and authentication enforcement within the instancePeers function of the OAuth Scope Handler in app/Http/Controllers/Api/ApiV1Controller.php.\nThe root cause is a logic error in how the application processes the ID argument passed to the API controller. When an attacker supplies a crafted ID parameter, the function fails to properly verify the requester's authentication status or authorization scope before returning sensitive data regarding instance peers.\nExploitation is performed remotely via standard network protocols, requiring no prior authentication or administrative privileges. An attacker can trigger the vulnerability by sending a maliciously crafted HTTP request targeting the affected endpoint. The lack of strict access control checks on the ID parameter allows the application to process the request as if it originated from an authorized session.\nThe attack flow proceeds as follows: First, the attacker identifies the API endpoint managed by instancePeers. Second, the attacker crafts a request containing an manipulated ID identifier. Third, the application's controller processes this ID without cross-referencing the requestor's identity against valid OAuth scopes or session tokens. Finally, the server returns the requested data, effectively bypassing the security boundary intended to restrict access to authenticated users only.\nBecause the exploit method is publicly documented, malicious actors can easily automate the discovery and extraction of instance data. Post-exploitation impact includes the unauthorized disclosure of internal instance configuration and peer information. In some architectural contexts, such bypasses may serve as a precursor to more complex attacks by providing attackers with the necessary information to map the internal network or identify further weaknesses in the OAuth implementation. The vulnerability persists across all Pixelfed versions up to 0.12.11, necessitating a patch to enforce mandatory authentication checks on all API calls handled by the controller."
}