Data Exposure Vulnerability in Mastodon Social Network Server

CVE-2026-72915

What is CVE-2026-72915?

Mastodon, a free and open-source social networking server, is susceptible to a data exposure issue affecting versions 4.6.0-beta.1 through 4.6.4 and 4.7.0-beta.1. This vulnerability enables any logged-in local user to exploit the show action in the admin collections controller, permitting access to personally identifiable information (PII) of other users within a collection. The flawed implementation allows unauthorized users to see another user's email address and last-used IP address, compromising user privacy. This issue has been addressed in the subsequent releases of Mastodon, specifically in versions 4.6.4 and 4.7.0-beta.1, ensuring enhanced security and user data protection.

References