Is CVE-2026-86178 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-86178?

CVE-2026-86178 has a CVSS v3 severity of MEDIUM (5.4).

Back

CVE-2026-86178

Description

Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author information without following the account.