CVE-2026-93960

MEDIUM 4.3

Pixelfed OAuth Scope ApiV1Controller.php instancePeers missing authentication

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1Controller.php of the component OAuth Scope Handler. Such manipulation of the argument ID leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and might be used. Upgrading to version 0.12.10 is recommended to address this issue. The name of the patch is 68dca5097305fa0065d029587b2233524636025a. Upgrading the affected component is advised.

CWE	CWE-306 CWE-287
Vendor	n/a
Product	pixelfed
Published	Sep 20, 2026

Stay Ahead of the Next One

Get instant alerts for n/a pixelfed

Be the first to know when new medium vulnerabilities affecting n/a pixelfed are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

n/a / Pixelfed

0.12.0 0.12.1 0.12.2 0.12.3 0.12.4 0.12.5 0.12.6 0.12.7 0.12.8 0.12.9 0.12.10 0.12.11

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/407919 vuldb.com: https://vuldb.com/vuln/407919/cti vuldb.com: https://vuldb.com/cve/CVE-2026-93960 vuldb.com: https://vuldb.com/submit/944207 github.com: https://github.com/pixelfed/pixelfed/issues/6643 github.com: https://github.com/pixelfed/pixelfed/pull/6774 github.com: https://github.com/pixelfed/pixelfed/commit/68dca5097305fa0065d029587b2233524636025a github.com: https://github.com/pixelfed/pixelfed/releases/tag/v0.12.10 github.com: https://github.com/pixelfed/pixelfed/

Credits

🔍 geochen (VulDB User)