CVE-2024-25108: Pixelfed Authorization Bypass Vulnerability

CVE-2024-25108 Overview

CVE-2024-25108 is an improper authorization vulnerability in Pixelfed, an open source federated photo sharing platform. The flaw stems from insufficient scope validation on OAuth bearer tokens, allowing authenticated attackers to access functionality far beyond what the token was granted, including administrative and moderator features. Every version of Pixelfed from v0.10.4 through v0.11.9 inclusive is affected. The maintainers addressed the issue in version 0.11.11. A proof of concept exists, and the vulnerability affects every local user of a Pixelfed instance and can impact the server's ability to federate with other Fediverse instances.

Critical Impact
Any authenticated user on a vulnerable Pixelfed server can escalate privileges to reach administrative and moderator functionality, compromising the confidentiality, integrity, and availability of the instance.

Affected Products

Pixelfed versions v0.10.4 through v0.11.9 (inclusive)
Pixelfed OAuth bearer token authentication component
Pixelfed API v2 endpoints exposed by ApiV2Controller

Discovery Timeline

2024-02-12 - CVE-2024-25108 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-25108

Vulnerability Analysis

The vulnerability is an improper authorization issue mapped to [CWE-863] (Incorrect Authorization) and [CWE-280] (Improper Handling of Insufficient Permissions or Privileges). Pixelfed issues OAuth bearer tokens with a defined set of scopes, but the server did not enforce those scopes when processing incoming API requests. As a result, a token issued with limited scopes was treated as if it possessed the full read write follow push scope set. An attacker holding any valid bearer token could invoke API endpoints reserved for higher-privilege operations, including administrative and moderator actions. Some user interaction is required to set up the preconditions, but the attack can be delivered in a time-delayed fashion that does not require the victim to be actively present.

Root Cause

Two distinct defects contributed to the issue. In app/Auth/BearerTokenResponse.php, the server returned a hardcoded scope string ('read write follow push') in the token response instead of the scopes actually granted to the access token. In app/Http/Controllers/Api/ApiV2Controller.php, endpoint handlers such as search() only verified that a user object was present. They did not verify that the request carried a valid OAuth token or that the token possessed the required scope, such as read.

Attack Vector

An attacker who is a local user of a Pixelfed instance obtains a bearer token, potentially through a limited-scope OAuth flow. Because scopes are not enforced at the request-processing layer, the attacker replays the token against sensitive API endpoints and gains access to administrative and moderator functionality. The attack is conducted over the network at low complexity and requires only low privileges on the target instance.

php

// Security patch in app/Auth/BearerTokenResponse.php
// Returns the token's actual granted scopes instead of a hardcoded string
    protected function getExtraParams(AccessTokenEntityInterface $accessToken)
    {
        return [
-           'created_at' => time(),
-           'scope' => 'read write follow push'
+           'created_at' => time(),
+           'scope' => implode(' ', $accessToken->getScopes())
        ];
    }

// Security patch in app/Http/Controllers/Api/ApiV2Controller.php
// Adds token presence and scope enforcement before processing the request
    public function search(Request $request)
    {
-       abort_if(!$request->user(), 403);
+       abort_if(!$request->user() || !$request->user()->token(), 403);
+       abort_unless($request->user()->tokenCan('read'), 403);

        $this->validate($request, [
            'q' => 'required|string|min:1|max:100',

Source: Pixelfed security patch commit 7e47d6d

Detection Methods for CVE-2024-25108

Indicators of Compromise

Requests from low-privilege user tokens hitting administrative or moderator API endpoints on Pixelfed instances running versions v0.10.4 through v0.11.9.
Unexpected changes to instance configuration, moderation queues, or user roles that do not correspond to a legitimate admin session.
OAuth token responses containing the hardcoded scope string read write follow push regardless of the scopes requested during authorization.

Detection Strategies

Review Pixelfed application and web server logs for API calls to administrative or moderator routes originating from tokens that should be scoped to read only.
Correlate OAuth token issuance events with subsequent API activity to identify tokens exercising privileges outside their granted scope.
Inspect the oauth_access_tokens table for tokens whose granted scopes do not match the privileges observed in access logs.

Monitoring Recommendations

Enable verbose access logging on the Pixelfed reverse proxy and forward events to a centralized log analytics platform for retention and search.
Alert on any HTTP 200 responses to admin or moderator API paths from user accounts that are not members of the administrator or moderator roles.
Track federation errors and unexpected outbound ActivityPub traffic that could indicate an attacker abusing elevated privileges to disrupt federation.

How to Mitigate CVE-2024-25108

Immediate Actions Required

Upgrade all Pixelfed instances to version 0.11.11 or later, which contains the fix for CVE-2024-25108.
Revoke and reissue all existing OAuth access tokens after upgrading so that legacy tokens with the hardcoded scope string are invalidated.
Audit administrator, moderator, and user account activity for unauthorized changes made prior to patching.

Patch Information

The fix is delivered in Pixelfed 0.11.11. The patch enforces scope checks in API controllers using tokenCan() and returns the access token's true granted scopes in the OAuth response. See the GitHub Security Advisory GHSA-gccq-h3xj-jgvf and the upstream commit 7e47d6d for the complete change set.

Workarounds

No workarounds are available according to the vendor. Upgrading to Pixelfed 0.11.11 is the only supported remediation.
Where immediate upgrade is not possible, restrict API access at the reverse proxy layer to trusted IP ranges to reduce exposure.

bash

# Example: upgrade a Pixelfed deployment to the patched release
cd /var/www/pixelfed
git fetch --tags
git checkout v0.11.11
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan config:cache
php artisan route:cache

# Revoke existing OAuth access tokens so pre-patch tokens cannot be reused
php artisan tinker --execute="DB::table('oauth_access_tokens')->update(['revoked' => 1]);"