CVE-2026-73211
Last modified
CVE-2026-73211 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including oAuthToken.accessToken, and take over administrator accounts.
Description
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including oAuthToken.accessToken, and take over administrator accounts. This issue is fixed in version 8.1.6.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Chocobozzz | PeerTube | < 8.1.6 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-73211?
How severe is CVE-2026-73211?
How do I fix CVE-2026-73211?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-7317A vulnerability was found in Grav CMS up to 1.7.49.5/2.0.0-b…5
- CVE-2026-7318A vulnerability was detected in elie mcp-project 0.1.0. The …5.9
- CVE-2026-7319A flaw has been found in elinsky execution-system-mcp 0.1.0.…7.3
- CVE-2026-7320Information disclosure due to incorrect boundary conditions …7.5
- CVE-2026-7321Sandbox escape due to incorrect boundary conditions in the W…9.6
- CVE-2026-73210A Server-Side Request Forgery (SSRF) vulnerability existed i…5.1
- CVE-2026-73212Coturn is a free open source implementation of TURN and STUN…5.8
- CVE-2026-73213Coturn is a free open source implementation of TURN and STUN…5.8
- CVE-2026-73214Coturn is a free open source implementation of TURN and STUN…8.2
- CVE-2026-73215Coturn is a free open source implementation of TURN and STUN…7.1
- CVE-2026-73216Coturn is a free open source implementation of TURN and STUN…6.5
- CVE-2026-73217Cursor is a code editor built for programming with AI. Prior…7.7
Are you affected by CVE-2026-73211?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST