CVE-2026-41259
Mastodon is a free, open-source social network server based on ActivityPub. Prior to v4.5.9, v4.4.16, and v4.3.22, Mastodon allows restricting new user sign-up based on e-mail domain names, and performs basic validation on e-mail addresses, but fails to restrict characters that are interpreted differently by some mailing servers. This vulnerability is fixed in v4.5.9, v4.4.16, and v4.3.22.
Ver en NVDAnálisis
Mastodon versions prior to 4.5.9, 4.4.16, and 4.3.22 are vulnerable to a registration bypass. Attackers can use specifically crafted email addresses with characters that bypass domain-based restrictions, allowing unauthorized account creation on restricted or private instances. Administrators should update to the latest patched versions to maintain control over user sign-ups.
Severidad
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCWE-841EPSS
Afecta
joinmastodon:mastodonDescripción técnica
Mastodon is a free, open-source social network server based on ActivityPub. Prior to v4.5.9, v4.4.16, and v4.3.22, Mastodon allows restricting new user sign-up based on e-mail domain names, and performs basic validation on e-mail addresses, but fails to restrict characters that are interpreted differently by some mailing servers. This vulnerability is fixed in v4.5.9, v4.4.16, and v4.3.22.