by Kastro
Paper/Archive/CVE-2026-73211

CVE-2026-73211

Chocobozzz PeerTube — PeerTube: Unauthenticated remote SQL injection in ActorFollowModel.updateScore()

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 54.1.541 × 2010.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including oAuthToken.accessToken, and take over administrator accounts. This issue is fixed in version 8.1.6.

Affected

ProductAffectedFixed inSource
PeerTube< 8.1.6–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/Chocobozzz/PeerTube/security/advisories/GHSA-pqr4-34h8-g39xrefgithub.com/Chocobozzz/PeerTube/commit/cc07364a5d635b6e43a92fc5e2e2e3eeacf4e8f4refgithub.com/Chocobozzz/PeerTube/releases/tag/v8.1.6refgithub.com/Chocobozzz/PeerTube/releases/tag/v8.1.8