PT-2026-2182 · Mastodon · Mastodon

Megamansec · CVE-2026-22246 · Published 2026-01-08 · Updated 2026-01-22

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mastodon versions 4.3 through 4.3.16 Mastodon versions 4.4 through 4.4.10 Mastodon versions 4.5 through 4.5.3

Description Mastodon is a free, open-source social network server based on ActivityPub. A flaw exists in the code handling the download of lists of severed relationships for a particular event. This code does not verify the ownership of the list before returning the lost relationships. Consequently, any registered local user can access lists of lost followers and followed users resulting from any severance event, effectively enumerating severance events across the system. The leaked information does not include the name of the account that lost follows and followers.

Recommendations Update Mastodon to version 4.3.17 or later. Update Mastodon to version 4.4.11 or later. Update Mastodon to version 4.5.4 or later.

Exploit

Fix

Weakness Enumeration

CWE-201

Related Identifiers

BIT-MASTODON-2026-22246

CVE-2026-22246

GHSA-WW85-X9CP-5V24

Affected Products

Mastodon

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22246.json · Exploit
• https://github.com/mastodon/mastodon/commit/b2bcd34486fd6681cc0f30028086ef0f47282adf · Patch
• https://github.com/mastodon/mastodon/commit/68e30985ca7afdb89af1b2e9dc962e1993dc8076 · Patch
• https://github.com/mastodon/mastodon/commit/c1fb6893c5175d74c074f6f786d504c8bc610d57 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-22246 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22246 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mastodon-2026-22246 · Vendor Advisory
• https://github.com/mastodon/mastodon/security/advisories/GHSA-ww85-x9cp-5v24 · Note
• https://twitter.com/CVEnew/status/2009291485632475640 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2009400816185020660 · Twitter Post
• https://t.me/CVEtracker/41736 · Telegram Post
• https://t.me/cveNotify/149541 · Telegram Post