Executive brief
Pixelfed is a photo-sharing platform similar to Instagram. The story feature (temporary photo/video content visible only to followers) contains an authorization flaw that allows any authenticated user to comment on or react to private accounts' stories without following them. This exposure reveals private story media URLs, usernames, and forces unwanted direct messages and notifications to victims, undermining the intended privacy controls.
Technical details
The vulnerability is a missing authorization check (CWE-862) in StoryComposeController and StoryApiV1Controller's comment() and react() endpoints. These endpoints validate only the story's can_reply or can_react flags, but fail to check whether the requester follows the story author or has visibility of it. An authenticated attacker can enumerate sequential story IDs and submit POST requests to /api/web/stories/v1/comment or /api/web/stories/v1/react with an arbitrary story ID; the controllers process the request, create DirectMessages and Notifications, and leak the story_media_url in the DM metadata. The vulnerability requires prior authentication but no follow relationship, block check, or visibility validation. Similar authorization logic exists in other endpoints (viewed(), storyPollVote()) but was omitted from the affected paths.
Affected products
- Pixelfed Pixelfed through 0.12.9
Timeline
- 2026-09-05: disclosed