Technical impact
Pixelfed versions up to 0.12.9 contain a failure to verify follower status in the StoryComposeController for react and comment endpoints. As a result, any authenticated user can submit reactions or comments to stories that are marked as follower‑only, triggering the API to reveal media URLs and author information that should be restricted to followers. This flaw allows attackers to gather data about non‑followed accounts without gaining follow permissions.
Affected Systems
The affected product is Pixelfed, maintained by the Pixelfed project, with version 0.12.9 being vulnerable. No newer version is listed as fixed in the current data. The issue resides in the API routes defined in routes/web‑api.php and the controller logic in app/Http/Controllers/StoryComposeController.php. Users running Pixelfed 0.12.9 or earlier deployments are at risk.
Risk and Exploitability
The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, so the likelihood of exploitation is unclear, but the flaw is directly exploitable via authenticated API requests. The vulnerability is not listed in the CISA KEV catalog and no public exploit has been reported. The attack vector is likely an authenticated HTTP API call; it does not require local privileges or network traversal, making it accessible to any legitimate user who can guess story identifiers. The extent of the impact is limited to data disclosure rather than system compromise.
