CVE-2025-30741

4.3 mediumEPSS 0.3%

Medium (4.3). EPSS 0.3% chance of exploitation in the next 30 days.

Pixelfed before 0.12.5 allows anyone to follow private accounts and see private posts on other Fediverse servers. This affects users elsewhere in the Fediverse, if they otherwise have any followers from a Pixelfed instance.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2025-03-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://fokus.cool/2025/03/25/pixelfed-vulnerability.html
https://github.com/pixelfed/pixelfed/releases/tag/v0.12.5
https://mastodon.social/@pixelfed/114215925957179498
https://news.ycombinator.com/item?id=43474425

Check your stack JSON