CVE-2026-73211criticalCWE-89

CVE-2026-73211: critical vulnerability in Chocobozzz PeerTube

PeerTube: Unauthenticated remote SQL injection in ActorFollowModel.updateScore()

Published

Follow this CVE+ Monitor PeerTube

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 0.7%
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including oAuthToken.accessToken, and take over administrator accounts. This issue is fixed in version 8.1.6.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Chocobozzz · PeerTube
Related CVEs — Chocobozzz PeerTube

In the same product, most dangerous first.

CVE-2026-57167MEDIUMPeerTube: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)EPSS 0.5%CVE-2026-73090CRITICALPeerTube: Cross-origin remote video takeover via Update activityEPSS 0.4%