Security Digest · Vulnerability record
CVE-2024-25108: Pixelfed doesn't check OAuth Scopes in API routes, giving elevated permissions
Pixelfed is an open source photo sharing platform.
CVSS 9.9 Critical EPSS 0.7% · p52
Should you act?
Critical and remotely reachable
No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.
- Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 0.7%, percentile 52: FIRST’s model estimates a 0.7% chance of exploitation activity in the next 30 days, higher than 52% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Only applies if your dependency tree includes
pixelfed/pixelfed(Composer (PHP)) >= 0.10.4, < 0.11.11, fixed in 0.11.11. Check your lockfile, including transitive dependencies.
What it is
Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to access far more functionality than users intended, including to the administrative and moderator functionality of the Pixelfed server. This vulnerability affects every version of Pixelfed between v0.10.4 and v0.11.9, inclusive. A proof of concept of this vulnerability exists. This vulnerability affects every local user of a Pixelfed server, and can potentially affect the servers' ability to federate. Some user interaction is required to setup the conditions to be able to exercise the vulnerability, but the attacker could conduct this attack time-delayed manner, where user interaction is not actively required. This vulnerability has been addressed in version 0.11.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.
From the GitHub advisory
Summary
When processing requests authorization was improperly and insufficiently checked, allowing attackers to access far more functionality than users intended, including to the administrative and moderator functionality of the Pixelfed server.
This vulnerability affects every version of Pixelfed between v0.10.4 and v0.11.9, inclusive. A proof of concept of this vulnerability exists.
Details
In vulnerable versions of Pixelfed (versions before 0.11.11), when the API checked the request for permissions to perform a certain behavior, it did not check that the OAuth Application/Client had granted access to those API endpoints, it only checked if the user was authenticated via an access token, and if the user was the owner of the resource or an admin on the instance.
Weakness type: CWE-280, CWE-285, CWE-863.
Product: pixelfed/pixelfed (Composer (PHP)) · Assigned by: GitHub_M · Published: 2024-02-12
Affected and fixed versions
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Composer (PHP) | pixelfed/pixelfed | >= 0.10.4, < 0.11.11 | 0.11.11 |
| Vendor | Product | Affected versions (per CVE record) |
|---|---|---|
| pixelfed | pixelfed | >= 0.10.4, < 0.11.11 |
Severity scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_M | 3.1 | 9.9 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L |
| GitHub | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L |
- Attack vector: network (remotely reachable)
- Attack complexity: low
- Privileges required: none (no login)
- User interaction: none
- Scope: changed (can affect other components)
CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.
Exploitation and urgency
- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc, automatable no, technical impact total.
- FIRST EPSS (model of 2026-10-21): 0.68% probability of exploitation activity in the next 30 days; percentile 52.
Timeline
- — CVE record published by GitHub_M
- — GitHub-reviewed advisory GHSA-gccq-h3xj-jgvf published (critical)
- — CVE record last updated
Sources and references
Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.
Vulnerability records
- GitHub Advisory GHSA-gccq-h3xj-jgvf github.com
- CVE.org record CVE-2024-25108 cve.org
- NVD entry CVE-2024-25108 nvd.nist.gov
Other references from the CVE record and advisory
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Critical Composer (PHP) advisories · Today’s Security Digest