Logic Errors in Mastodon Allow Suspended Users’ Posts to Reappear
CVE-2026-23961
What is CVE-2026-23961?
Mastodon, an open-source social network server based on ActivityPub, has a vulnerability that affects the handling of posts from suspended users. Server administrators can suspend users to prevent their interactions; however, due to certain logic errors, content from these suspended users may still appear in timelines. Known posts from suspended accounts can be revealed if boosted, while under specific circumstances, new posts from these users might bypass restrictions and show up. This issue persists across multiple versions of Mastodon, allowing previously hidden content to surface sporadically. Recent updates in versions v4.5.5, v4.4.12, and v4.3.18 include patches addressing this security flaw.
Affected Version(s)
mastodon < 4.3.18 < 4.3.18
mastodon >= 4.4.0, < 4.4.12 < 4.4.0, 4.4.12
mastodon >= 4.5.0, < 4.5.5 < 4.5.0, 4.5.5