CVE-2025-30741

Published: Mar 25, 2025Modified: Jun 17, 2026Deferred

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: MITRE (Secondary)

Description

Pixelfed before 0.12.5 allows anyone to follow private accounts and see private posts on other Fediverse servers. This affects users elsewhere in the Fediverse, if they otherwise have any followers from a Pixelfed instance.

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (4)

https://fokus.cool/2025/03/25/pixelfed-vulnerability.html

Source: cve@mitre.org

https://github.com/pixelfed/pixelfed/releases/tag/v0.12.5

Source: cve@mitre.org

https://mastodon.social/@pixelfed/114215925957179498

Source: cve@mitre.org

https://news.ycombinator.com/item?id=43474425

Source: cve@mitre.org

Timeline

No history available yet.