The flaw resides in the instancePeers method of Pixelfed’s OAuth scope handler; the function fails to enforce authentication when the ID argument is manipulated, allowing any remote caller to retrieve peer data. This omission constitutes an authentication bypass that could expose private information about users’ peers and aligns with CWE-287 and CWE-306. The vulnerability offers an attacker the ability to read data that should be protected by credentials, thereby compromising confidentiality.

Pixelfed installations running version 0.12.11 or earlier are affected. The vendor patch, identified by commit 68dca5097305fa0065d029587b2233524636025a, is included in release v0.12.10 and in all subsequent releases. Administrators should verify that their deployment matches or exceeds this version to eliminate the flaw.

The CVSS score of 5.3 reflects moderate severity; the EPSS score is not available but the vulnerability is publicly disclosed and can be executed from a remote location. The issue is not yet listed in CISA’s KEV catalog, but the presence of a public exploit means that the risk exists until the fix is applied. An attacker who succeeds could read peer information that should otherwise be protected by authentication, potentially leading to broader compromise through social engineering or credential reuse.