CVE-2026-73211

CRITICAL 9.8

PeerTube: Unauthenticated remote SQL injection in ActorFollowModel.updateScore()

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including oAuthToken.accessToken, and take over administrator accounts. This issue is fixed in version 8.1.6.

CWE	CWE-89
Vendor	chocobozzz
Product	peertube
Published	Aug 11, 2026

Stay Ahead of the Next One

Get instant alerts for chocobozzz peertube

Be the first to know when new critical vulnerabilities affecting chocobozzz peertube are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Chocobozzz / PeerTube

< 8.1.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-pqr4-34h8-g39x github.com: https://github.com/Chocobozzz/PeerTube/commit/cc07364a5d635b6e43a92fc5e2e2e3eeacf4e8f4 github.com: https://github.com/Chocobozzz/PeerTube/releases/tag/v8.1.6 github.com: https://github.com/Chocobozzz/PeerTube/releases/tag/v8.1.8