Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-47777— Mastodon has a consent-check bypass in its remote Collections

Quick assessment

Affected
mastodon mastodon
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Mastodon mastodon是Mastodon组织的社交网络服务软件。 Mastodon存在安全漏洞，该漏洞源于对远程账户同意在远程Collection中展示的检查条件缺失，可能导致攻击者绕过检查并伪造同意，通过伪造用于验证同意的FeatureAuthorization对象，使未授权的账户出现在Collection中。受影响版本为运行主线分支或每日构建且启用了实验性Collections功能的版本。

CVSS 7.5 · High EPSS 0.22% · P11

Possible ATT&CK Techniques 1 AI

T1134 · Access Token Manipulation

Affected Version Matrix 1

VendorProduct Version RangeStatus
mastodon mastodon >= nightly.2026-03-10, < 4.6.0-beta.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-47777

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Mastodon has a consent-check bypass in its remote Collections
Source: CVE Program / CVE List V5
Vulnerability Description
Mastodon is a free, open-source social network server based on ActivityPub. In versions there is a missing condition in the check if remote accounts consented to be featured in a remote Collection could lead to attackers bypassing the check and faking consent. An attacker could forge the FeatureAuthorization object that is used to verify consent to be featured in a Collection and thus make it appear as if an account is allowed to be in a Collection when it actually is not. While the FeatureAuthorization must reside on the same domain as the object it is for, a check is missing to make sure said object is actually the same as in the Collection item. This allows an attacker to forge the authorization. Mastodon servers are affected only if running the main branch or nightly builds who have opted into testing the experimental "Collections" feature by setting the environment variable EXPERIMENTAL_FEATURES to a value including collections. This has been patched in version 4.6.0-beta.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5
Vulnerability Title
Mastodon 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Mastodon mastodon是Mastodon组织的社交网络服务软件。 Mastodon存在安全漏洞，该漏洞源于对远程账户同意在远程Collection中展示的检查条件缺失，可能导致攻击者绕过检查并伪造同意，通过伪造用于验证同意的FeatureAuthorization对象，使未授权的账户出现在Collection中。受影响版本为运行主线分支或每日构建且启用了实验性Collections功能的版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
mastodon mastodon >= nightly.2026-03-10, < 4.6.0-beta.1 -

II. Public POCs for CVE-2026-47777

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-47777

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-47777 (1)

Vendor Advisories for CVE-2026-47777 (1)

IV. Related Vulnerabilities

Same product: mastodon
Same vendor: mastodon
Same weakness: CWE-345

V. Comments for CVE-2026-47777

No comments yet

Leave a comment