CVE-2026-93960 (GCVE-0-2026-93960)
Vulnerability from cvelistv5
Published
2026-09-20 03:00
Modified
2026-09-22 18:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1Controller.php of the component OAuth Scope Handler. Such manipulation of the argument ID leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and might be used. Upgrading to version 0.12.10 is recommended to address this issue. The name of the patch is 68dca5097305fa0065d029587b2233524636025a. Upgrading the affected component is advised.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93960",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T18:19:01.638760Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T18:19:23.478Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://vuldb.com/submit/944207"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:pixelfed:pixelfed:*:*:*:*:*:*:*:*"
],
"modules": [
"OAuth Scope Handler"
],
"product": "Pixelfed",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "0.12.0"
},
{
"status": "affected",
"version": "0.12.1"
},
{
"status": "affected",
"version": "0.12.2"
},
{
"status": "affected",
"version": "0.12.3"
},
{
"status": "affected",
"version": "0.12.4"
},
{
"status": "affected",
"version": "0.12.5"
},
{
"status": "affected",
"version": "0.12.6"
},
{
"status": "affected",
"version": "0.12.7"
},
{
"status": "affected",
"version": "0.12.8"
},
{
"status": "affected",
"version": "0.12.9"
},
{
"status": "affected",
"version": "0.12.10"
},
{
"status": "affected",
"version": "0.12.11"
},
{
"status": "unaffected",
"version": "0.12.10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "geochen (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1Controller.php of the component OAuth Scope Handler. Such manipulation of the argument ID leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and might be used. Upgrading to version 0.12.10 is recommended to address this issue. The name of the patch is 68dca5097305fa0065d029587b2233524636025a. Upgrading the affected component is advised."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-20T03:00:19.652Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-407919 | Pixelfed OAuth Scope ApiV1Controller.php instancePeers missing authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/407919"
},
{
"name": "VDB-407919 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/407919/cti"
},
{
"name": "CVE-2026-93960 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-93960"
},
{
"name": "Submit #944207 | pixelfed commit f0ac4aa Missing Authentication",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/944207"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/pixelfed/pixelfed/issues/6643"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/pixelfed/pixelfed/pull/6774"
},
{
"tags": [
"patch"
],
"url": "https://github.com/pixelfed/pixelfed/commit/68dca5097305fa0065d029587b2233524636025a"
},
{
"tags": [
"patch"
],
"url": "https://github.com/pixelfed/pixelfed/releases/tag/v0.12.10"
},
{
"tags": [
"product"
],
"url": "https://github.com/pixelfed/pixelfed/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-09-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-19T11:22:00.000Z",
"value": "VulDB entry last update"
}
],
"title": "Pixelfed OAuth Scope ApiV1Controller.php instancePeers missing authentication",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-93960",
"datePublished": "2026-09-20T03:00:19.652Z",
"dateReserved": "2026-09-19T09:16:56.504Z",
"dateUpdated": "2026-09-22T18:19:23.478Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-93960\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-22T18:19:01.638760Z\"}}}], \"references\": [{\"url\": \"https://vuldb.com/submit/944207\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-22T18:18:38.695Z\"}}], \"cna\": {\"tags\": [\"x_open-source\"], \"title\": \"Pixelfed OAuth Scope ApiV1Controller.php instancePeers missing authentication\", \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"geochen (VulDB User)\"}], \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P\"}}, {\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 4.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C\"}}, {\"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 4.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C\"}}, {\"cvssV2_0\": {\"version\": \"2.0\", \"baseScore\": 4, \"vectorString\": \"AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C\"}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:pixelfed:pixelfed:*:*:*:*:*:*:*:*\"], \"vendor\": \"n/a\", \"modules\": [\"OAuth Scope Handler\"], \"product\": \"Pixelfed\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.12.0\"}, {\"status\": \"affected\", \"version\": \"0.12.1\"}, {\"status\": \"affected\", \"version\": \"0.12.2\"}, {\"status\": \"affected\", \"version\": \"0.12.3\"}, {\"status\": \"affected\", \"version\": \"0.12.4\"}, {\"status\": \"affected\", \"version\": \"0.12.5\"}, {\"status\": \"affected\", \"version\": \"0.12.6\"}, {\"status\": \"affected\", \"version\": \"0.12.7\"}, {\"status\": \"affected\", \"version\": \"0.12.8\"}, {\"status\": \"affected\", \"version\": \"0.12.9\"}, {\"status\": \"affected\", \"version\": \"0.12.10\"}, {\"status\": \"affected\", \"version\": \"0.12.11\"}, {\"status\": \"unaffected\", \"version\": \"0.12.10\"}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-09-19T00:00:00.000Z\", \"value\": \"Advisory disclosed\"}, {\"lang\": \"en\", \"time\": \"2026-09-19T02:00:00.000Z\", \"value\": \"VulDB entry created\"}, {\"lang\": \"en\", \"time\": \"2026-09-19T11:22:00.000Z\", \"value\": \"VulDB entry last update\"}], \"references\": [{\"url\": \"https://vuldb.com/vuln/407919\", \"name\": \"VDB-407919 | Pixelfed OAuth Scope ApiV1Controller.php instancePeers missing authentication\", \"tags\": [\"vdb-entry\", \"technical-description\"]}, {\"url\": \"https://vuldb.com/vuln/407919/cti\", \"name\": \"VDB-407919 | CTI Indicators (IOB, IOC, IOA)\", \"tags\": [\"signature\", \"permissions-required\"]}, {\"url\": \"https://vuldb.com/cve/CVE-2026-93960\", \"name\": \"CVE-2026-93960 | CVE Analysis and Report\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://vuldb.com/submit/944207\", \"name\": \"Submit #944207 | pixelfed commit f0ac4aa Missing Authentication\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://github.com/pixelfed/pixelfed/issues/6643\", \"tags\": [\"exploit\", \"issue-tracking\"]}, {\"url\": \"https://github.com/pixelfed/pixelfed/pull/6774\", \"tags\": [\"issue-tracking\", \"patch\"]}, {\"url\": \"https://github.com/pixelfed/pixelfed/commit/68dca5097305fa0065d029587b2233524636025a\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/pixelfed/pixelfed/releases/tag/v0.12.10\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/pixelfed/pixelfed/\", \"tags\": [\"product\"]}], \"x_generator\": [\"VulDB PVTS v202609\"], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1Controller.php of the component OAuth Scope Handler. Such manipulation of the argument ID leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and might be used. Upgrading to version 0.12.10 is recommended to address this issue. The name of the patch is 68dca5097305fa0065d029587b2233524636025a. Upgrading the affected component is advised.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-306\", \"description\": \"Missing Authentication\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-287\", \"description\": \"Improper Authentication\"}]}], \"providerMetadata\": {\"orgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"shortName\": \"VulDB\", \"dateUpdated\": \"2026-09-20T03:00:19.652Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-93960\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-22T18:19:23.478Z\", \"dateReserved\": \"2026-09-19T09:16:56.504Z\", \"assignerOrgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"datePublished\": \"2026-09-20T03:00:19.652Z\", \"assignerShortName\": \"VulDB\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…