[ blog ]
PeerTube Updated to 8.2.4
published
We’ve updated P.LU to PeerTube 8.2.4.
PeerTube published 8.2.4 on August 4, 2026. P.LU moved directly from 8.2.3, which is inside the affected range for both vulnerabilities disclosed with this release.
ActivityPub playlist takeover
GHSA-37jf-59fg-9hpr is rated critical with a CVSS score of 9.1. PeerTube versions before 8.2.4 accepted a signed ActivityPub Update for a remote account without confirming that the account in the message matched the account that signed it.
An unauthenticated remote attacker could use that mismatch to rebind an actor’s url field and bypass playlist update verification. The advisory says this allowed the attacker to change the name and public UUID of any local playlist. PeerTube 8.2.4 adds the missing identity check.
Email verification bypass
GHSA-wp9f-cmff-p8r2 is rated medium with a CVSS score of 6.5. PeerTube reused the same verification token for new-account verification and changes to an existing account’s email address. The server then trusted the client-controlled isPendingEmail parameter to decide which action the token authorized.
That mix-up allowed email addresses to be claimed without proof of ownership. The advisory lists every version before 8.2.4 as affected and 8.2.4 as the patched release.
Additional hardening
The 8.2.4 release notes list two more hardening changes. PeerTube now performs additional checks when receiving remote views and downloads, and other users or anonymous visitors can no longer request channel statistics through the withStats query parameter.
Upstream does not assign separate advisory identifiers or severity ratings to those two changes. As of August 19, 2026, neither of the two published GHSAs lists a CVE identifier.
Upgrade notes
Upstream does not list a database migration, configuration change, or new runtime requirement for 8.2.4. The version boundary is direct: PeerTube 8.2.3 and earlier are affected, while 8.2.4 contains the fixes.
Official release link
[ share ]