CVE-2025-30741

Pixelfed may allow unauthorized actor to view private posts and private users

4.3 MediumFix available

Pixelfed before 0.12.5 allows anyone to follow private accounts and see private posts on other Fediverse servers. This affects users elsewhere in the Fediverse, if they otherwise have any followers from a Pixelfed instance.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.32%Up 0.3 points since Mar 26, 2025

What each source reports

CVE List Score used 4.3

Record: CVE-2025-30741
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-863
Updated: 2026-11-02

EUVDEUVD-2025-8084 4.3

Record: EUVD-2025-8084
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-7287-grhx-542x 4.3

Pixelfed may allow unauthorized actor to view private posts and private users

Record: GHSA-7287-grhx-542x
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-863
Updated: 2026-11-02

NVD 4.3

Record: CVE-2025-30741
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-863
Updated: 2026-11-02

OSV 4.3

Record: CVE-2025-30741
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-863
Updated: 2026-11-02

OSVGHSA-7287-grhx-542x 4.3

Pixelfed may allow unauthorized actor to view private posts and private users

Record: GHSA-7287-grhx-542x
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-863
Updated: 2026-11-02

Affected products

pixelfed

Affected packages

Affected packages
Package	Affected	Fixed
`pixelfed/pixelfed` Packagist	before 0.12.5	0.12.5
`pixelfed/pixelfed` Packagist	before 0.12.5, plus listed versions v0.1.9v0.10.0v0.10.1v0.10.10v0.10.2 Show 37 moreShow less v0.10.3v0.10.4v0.10.5v0.10.6v0.10.7v0.10.8v0.10.9v0.11.0v0.11.1v0.11.10v0.11.11v0.11.12v0.11.13v0.11.2v0.11.3v0.11.4v0.11.5v0.11.6v0.11.7v0.11.8v0.11.9v0.12.0v0.12.1v0.12.2v0.12.3v0.12.4v0.5.9v0.6.0v0.6.1v0.7.6v0.8.0v0.8.5v0.8.6v0.9.0v0.9.4v0.9.5v0.9.6	0.12.5

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-30741 is a medium vulnerability (CVSS 4.3) in Pixelfed, published March 25, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 24th percentile. Fixed in pixelfed/pixelfed 0.12.5.