SB2026090719 - Multiple vulnerabilities in Mastodon

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026090719

SB2026090719 - Multiple vulnerabilities in Mastodon

Published: September 7, 2026 Updated: November 6, 2026

Security Bulletin ID SB2026090719
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to restore their ability to log in.

The vulnerability exists due to incomplete permission checks in the admin API when handling requests from staff accounts disabled through the Freeze action. A remote privileged user can invoke admin API endpoints to restore their ability to log in.

The issue is specific to accounts disabled through the Freeze action; accounts demoted from their roles or suspended lose API access.


2) Improper Authentication (CVE-ID: N/A)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to log in to affected accounts without a valid password.

The vulnerability exists due to improper authentication in Mastodon's authentication flow when processing sign-in attempts for accounts without database-stored passwords. A remote attacker can provide any password and proceed to second-factor authentication to log in to affected accounts without a valid password.

Exploitation requires a valid security key, backup code, or TOTP token for an account with two-factor authentication enabled that uses LDAP, PAM, or server-configured SSO.


3) Inefficient Algorithmic Complexity (CVE-ID: N/A)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to cause a denial of service in Mastodon.

The vulnerability exists due to missing safeguards against pathological JSON-LD inputs to the RDF Dataset Canonicalization algorithm used by Mastodon when verifying Linked Data Signatures. An unauthenticated remote attacker can submit crafted activities that each take up to several minutes to process without requiring victim interaction.


Remediation

Install update from vendor's website.

References