Wow, this Pixelfed bug is *nasty*. Allowed users to access private posts of remote users they're not following so long as another user on the same Pixelfed server legitimately followed that account.
If you're running a Pixelfed server, definitely upgrade immediately now that the vulnerability is publicly known.