SB20261106113 - Multiple vulnerabilities in Mastodon
Published: November 6, 2026
Security Bulletin ID
SB20261106113
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Improper Authentication (CVE-ID: N/A)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated remote attacker to impersonate other remote actors in Mastodon.
The vulnerability exists due to insufficient authentication of ActivityPub identifiers when Mastodon processes incoming posts and quote or collection approval stamps. An unauthenticated remote attacker can craft these posts and approval stamps so they appear to originate from another remote actor rather than the actual sender.
Remediation
Install update from vendor's website.