CVE-2026-93960

A vulnerability in Pixelfed (up to version 0.12.11 ) affects the OAuth Scope Handler component, specifically the instancePeers function in app/Http/Controllers/Api/ApiV1Controller.php. Manipulation of the ID argument leads to missing authentication , enabling a remote attacker with low privileges...