{"action":"Upgrade pixelfed/pixelfed to 0.11.11 or later.","affected":[{"fixed":"0.11.11","introduced":"0.10.4"}],"component":"pixelfed/pixelfed","cve_ids":["CVE-2024-25108"],"ecosystem":"Packagist","epss":0.00678,"exploited":false,"fixed_versions":["0.11.11"],"ghsa_id":"GHSA-gccq-h3xj-jgvf","id":"tcs_01M5KF2KW85MJKZZBT342C9AE4","modified_at":"2026-09-10T03:50:05.560853485Z","published_at":"2024-02-12T15:17:23Z","references":["https://osv.dev/vulnerability/GHSA-gccq-h3xj-jgvf","https://github.com/pixelfed/pixelfed/security/advisories/GHSA-gccq-h3xj-jgvf","https://nvd.nist.gov/vuln/detail/CVE-2024-25108","https://github.com/pixelfed/pixelfed/commit/7e47d6dccb0393a2e95c42813c562c854882b037","https://github.com/pixelfed/pixelfed/commit/fd7f5dbb","https://github.com/pixelfed/pixelfed/commit/fd7f5dbba13818f60d1c2b3ab110b499e996aa81","https://github.com/pixelfed/pixelfed"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"GHSA-gccq-h3xj-jgvf","url":"https://osv.dev/vulnerability/GHSA-gccq-h3xj-jgvf"}],"summary":"Pixelfed doesn't check OAuth Scopes in API routes, giving elevated permissions"}