Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the activity creation process when a user with the createactivity permission accesses the preset project creation route directly. An attacker can create new activities under unauthorized projects by specifying ...

CVE-2025-32948

PeerTube (inbox via ActivityPub) is affected by CVE-2025-32948, where mishandling of Create Activity can be abused to crash the server or trigger blind SSRF by sending crafted ActivityPub activities to the inbox. The vulnerability arises from handling ActivityPub activities in playlists, enabling...

CVE-2025-32948: Access of Resource Using Incompatible Type

The vulnerability allows any attacker to cause the PeerTube server to stop functioning, or in special cases send requests to arbitrary URLs Blind SSRF. Attackers can send ActivityPub activities to PeerTube's "inbox" endpoint. By abusing the "Create Activity" functionality, it is possible to creat...