CVE-2026-73211
Last modified
CVE-2026-73211 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including oAuthToken.accessToken, and take over administrator accounts. EPSS estimates a 0.39% chance of exploitation in the next 30 days.
Description
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including oAuthToken.accessToken, and take over administrator accounts. This issue is fixed in version 8.1.6.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Chocobozzz | PeerTube | < 8.1.6 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-73211?
How severe is CVE-2026-73211?
How do I fix CVE-2026-73211?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-73199A flaw was found in the `ipa-enrollment` SLAPI plugin. A rem…6.5
- CVE-2026-7320Information disclosure due to incorrect boundary conditions …7.5
- CVE-2026-73208An attacker that holds a token intended for a different purp…7.4
- CVE-2026-73209An attacker that has valid credentials can send crafted comp…6.5
- CVE-2026-7321Sandbox escape due to incorrect boundary conditions in the W…9.6
- CVE-2026-73210A Server-Side Request Forgery (SSRF) vulnerability existed i…5.1
- CVE-2026-73212Coturn is a free open source implementation of TURN and STUN…5.8
- CVE-2026-73213Coturn is a free open source implementation of TURN and STUN…5.8
- CVE-2026-73214Coturn is a free open source implementation of TURN and STUN…8.2
- CVE-2026-73215Coturn is a free open source implementation of TURN and STUN…7.1
- CVE-2026-73216Coturn is a free open source implementation of TURN and STUN…6.5
- CVE-2026-73217Cursor is a code editor built for programming with AI. Prior…7.7
Are you affected by CVE-2026-73211?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST