Mastodon up to 4.6.0-beta.0 Setting data authenticity

Summaryinfo

A vulnerability was found in Mastodon up to 4.6.0-beta.0. It has been classified as problematic. This issue affects some unknown processing of the component Setting Handler. Performing a manipulation results in data authenticity. This vulnerability is known as CVE-2026-47777. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic has been found in Mastodon up to 4.6.0-beta.0. This affects an unknown code block of the component Setting Handler. The manipulation with an unknown input leads to a data authenticity vulnerability. CWE is classifying the issue as CWE-345. The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. This is going to have an impact on integrity. The summary by CVE is:

Mastodon is a free, open-source social network server based on ActivityPub. In versions there is a missing condition in the check if remote accounts consented to be featured in a remote Collection could lead to attackers bypassing the check and faking consent. An attacker could forge the FeatureAuthorization object that is used to verify consent to be featured in a Collection and thus make it appear as if an account is allowed to be in a Collection when it actually is not. While the FeatureAuthorization must reside on the same domain as the object it is for, a check is missing to make sure said object is actually the same as in the Collection item. This allows an attacker to forge the authorization. Mastodon servers are affected only if running the main branch or nightly builds who have opted into testing the experimental "Collections" feature by setting the environment variable EXPERIMENTAL_FEATURES to a value including collections. This has been patched in version 4.6.0-beta.1.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-47777 since 05/20/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 4.6.0-beta.1 eliminates this vulnerability. Applying the patch 22203f8aeb03e8f14dc62e253e83db39825a5bcf is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Mastodon

Version

• 4.6.0-beta

License

• open-source

Website

• Product: https://github.com/mastodon/mastodon/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion