Is CVE-2026-73211 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-73211?

CVE-2026-73211 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-73211

Description

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including oAuthToken.accessToken, and take over administrator accounts. This issue is fixed in version 8.1.6.