CVE-2024-25108

CVE-2024-25108 is a critical authorization bypass vulnerability in Pixelfed versions 0.10.4 through 0.11.9, allowing authenticated attackers to gain unauthorized access to administrative and moderator functionalities due to insufficient authorization checks. With a CVSS score of 8.8 (High), this vulnerability has a network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While a proof of concept exists, there is no evidence of active exploitation in the wild, nor are there public Metasploit or Nuclei modules. The vulnerability has garnered some community discussion, and users are strongly advised to upgrade to version 0.11.11 to mitigate the risk.