CVE-2026-93960

A vulnerability in Pixelfed (up to version 0.12.11 ) affects the OAuth Scope Handler component, specifically the instancePeers function in app/Http/Controllers/Api/ApiV1Controller.php. Manipulation of the ID argument leads to missing authentication , enabling a remote attacker with low privileges...

CVE-2026-93960 Pixelfed OAuth Scope ApiV1Controller.php instancePeers missing authentication

A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1Controller.php of the component OAuth Scope Handler. Such manipulation of the argument ID leads to missing authentication. The attack may be performed from...

CVE-2026-93960 Pixelfed OAuth Scope ApiV1Controller.php instancePeers missing authentication

A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1Controller.php of the component OAuth Scope Handler. Such manipulation of the argument ID leads to missing authentication. The attack may be performed from...

PT-2026-95907

Name of the Vulnerable Software and Affected Versions Pixelfed versions prior to 0.12.10 Description An issue exists in the OAuth Scope Handler component within the instancePeers function of the app/Http/Controllers/Api/ApiV1Controller.php file. Remote manipulation of the ID argument can lead to...