← Back

CVE-2026-33869

nvd nist
Published: Mar 27, 2026Modified: Jun 17, 2026

JSON object

Loading...
4.8
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Exploitability: 2.2 / Impact: 2.5
Source: security-advisories@github.com (Secondary)

Description

Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.5.x branch prior to 4.5.8 and on the 4.4.x branch prior to 4.4.15, an attacker that knows of a quote before it has reached a server can prevent it from being correctly processed on that server. The vulnerability has been patched in Mastodon 4.5.8 and 4.4.15. Mastodon 4.3 and earlier are not affected because they do not support quotes.

Affected (2)

Joinmastodon
1 product
Mastodon
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Joinmastodon
Mastodon
From 4.4.0 to 4.4.15
Mastodon
From 4.5.0 to 4.5.8

Related CWEs

CWE-863
Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (1)

Source: security-advisories@github.com
Vendor Advisory

Timeline

No history available yet.