53 matches found
CVE-2025-30741
CVE-2025-30741 affects Pixelfed before 0.12.5, where insufficient verification of follow requests allows an unauthenticated actor to follow private accounts and view private posts on other Fediverse servers. This can expose private content to users who have followers from a Pixelfed instance. The...
CVE-2024-25108
Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to access far more functionality than users intended, including to the administrative and moderator functionality of the Pixelfed server. This...
The vulnerability of the application programming interface of the Pixelfed shared-use platform allows a violator to enhance their privileges.
The vulnerability of the application programming interface of the Pixelfed shared-use platform is related to incorrect handling of insufficient resolutions or privileges. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...
Authorization Bypass
pixelfed/pixelfed is vulnerable to Authorization Bypass. The vulnerability is due to insufficient checks during request processing, allowing attackers to access and potentially modify administrative and moderator functionalities beyond intended user permissions...
CVE-2024-25108
Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to access far more functionality than users intended, including to the administrative and moderator functionality of the Pixelfed server. This...
Design/Logic Flaw
Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to access far more functionality than users intended, including to the administrative and moderator functionality of the Pixelfed server. This...
CVE-2024-25108 Insufficient authorization allowing elevated access to resources in pixelfed
Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to access far more functionality than users intended, including to the administrative and moderator functionality of the Pixelfed server. This...
CVE-2024-25108
Pixelfed suffers an authorization-check bypass that lets authenticated users obtain access to administrative and moderator functionality. Affected versions are v0.10.4 through v0.11.9 (inclusive); a proof-of-concept exists. Root cause: improper and insufficient checks during request processing al...
CVE-2024-25108 Insufficient authorization allowing elevated access to resources in pixelfed
Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to access far more functionality than users intended, including to the administrative and moderator functionality of the Pixelfed server. This...
CVE-2024-25108 Insufficient authorization allowing elevated access to resources in pixelfed
Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to access far more functionality than users intended, including to the administrative and moderator functionality of the Pixelfed server. This...
Pixelfed doesn't check OAuth Scopes in API routes, giving elevated permissions
Summary When processing requests authorization was improperly and insufficiently checked, allowing attackers to access far more functionality than users intended, including to the administrative and moderator functionality of the Pixelfed server. This vulnerability affects every version of Pixelf...
GHSA-GCCQ-H3XJ-JGVF Pixelfed doesn't check OAuth Scopes in API routes, giving elevated permissions
Summary When processing requests authorization was improperly and insufficiently checked, allowing attackers to access far more functionality than users intended, including to the administrative and moderator functionality of the Pixelfed server. This vulnerability affects every version of Pixelf...
Pixelfed Security Vulnerability
Pixelfed is a free and ethical photo sharing platform from the individual developers of Pixelfed. A security vulnerability exists in Pixelfed versions v0.10.4 through 0.11.11, which stems from an incorrect and insufficient authorization check for processing requests, which could allow an attacker...
PT-2024-2061 · Pixelfed · Pixelfed
Name of the Vulnerable Software and Affected Versions: Pixelfed versions 0.10.4 through 0.11.9 Description: The issue arises from improper and insufficient authorization checks when processing requests, allowing attackers to access more functionality than intended, including administrative and...
Information Disclosure
pixelfed/pixelfed is vulnerable to Information Disclosure. A remote unauthenticated attacker is able to enumerate valid usernames and emails, resulting in the disclosure of sensitive information...
Stored HTML injection and Potential Cross Site Scripting in pixelfed ≤ 0.11.4
Description pixelfed ≤ 0.11.4 is affected by HTML injection and Potential Cross Site Scripting vulnerability. Steps to Reproduce: 1.Choose any server from https://pixelfed.org/servers and go to registration page. 2.Enter your username, email, password and enter following payload on "Name" paramet...
Pixelfed may allow unauthorized actor to view private posts
Improper Authorization in GitHub repository pixelfed/pixelfed 0.11.4 and prior...
GHSA-QH6W-PQ52-QXXQ Pixelfed may allow unauthorized actor to view private posts
Improper Authorization in GitHub repository pixelfed/pixelfed 0.11.4 and prior...
