CVE-2026-73211

COMPONENT VERSION RANGE

NewScan fingerprints PeerTube from its response and reports this CVE when the detected version falls inside the affected range below.

CVE-2026-73211 (CVSS 9.8, GHSA-pqr4-34h8-g39x): ActorFollowModel.updateScore() interpolates a remote ActivityPub actor's inboxUrl straight into SQL, so ANY federating server - no account, no credential on this instance - reads and writes the PeerTube database, oAuthToken.accessToken included, and takes over administrators. Fixed 8.1.6. CVE-2026-73090 (9.9, GHSA-g9p4-f7h8-hc86) rides along on this range: processUpdateActivity/processUpdateVideo accept an Update whose Video object belongs to another host, letting a malicious peer rewrite a video's metadata, visibility and media/HLS URLs - i.e. serve their file under someone else's channel. Fixed 8.2.2, hence fixed_in here: on a pre-8.1.6 install 8.1.6 clears the SQLi but not the takeover, and only 8.2.2 clears both. Version-match only, and it can never be otherwise: both vectors are reached by SPEAKING ActivityPub to the instance as a peer, so an in-band confirmation would mean writing to a stranger's database or rewriting their videos. The 8.1.6-8.2.1 window is the row below. (OSV's derived `versions` enumeration omits 8.1.3-8.1.5 from 73090 while its authoritative `ranges` field says introduced:0 -> fixed:8.2.2, matching the advisory text; the ranges field is what this follows. A 8.1.3-8.1.5 install is inside the 73211 range either way, so it is told to upgrade regardless and the disagreement cannot cost a finding.)