CVE-2026-22246
Insecure Direct Object Reference in Mastodon Severed Relationships Disclosure
Publication date: 2026-01-08
Last updated on: 2026-01-08
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mastodon | mastodon | to 4.3.17 (exc) |
| mastodon | mastodon | to 4.4.11 (exc) |
| mastodon | mastodon | to 4.5.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-201 | The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Mastodon allows any registered local user to access downloadable lists of severed relationships (lost followers and followed users) caused by moderation actions for any other user's severance events. The issue arises because the code fails to verify that the requesting user owns the severance event before returning the data. Although the leaked information does not include the names of the accounts that lost followers or follows, it still exposes sensitive relationship information. This flaw was fixed by restricting access so that users can only retrieve severed relationship events associated with their own account. [2, 1]
How can this vulnerability impact me? :
The vulnerability can impact you by exposing sensitive information about your social network relationships to other registered users on the Mastodon server. Specifically, other users could enumerate and access lists of your lost followers and followed users caused by moderation actions without your permission. This unauthorized disclosure affects the confidentiality of your relationship data, potentially leading to privacy concerns or unwanted exposure of your social connections. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to access severed relationship events for accounts other than the currently authenticated user via the endpoints `/severed_relationships/:id/following` or `/severed_relationships/:id/followers` requesting CSV format. If unauthorized access is possible and the server returns data instead of a 404 Not Found response, the system is vulnerable. Specific commands would involve authenticated HTTP requests (e.g., using curl) to these endpoints with IDs of severance events not belonging to the authenticated user, checking if data is returned or access is denied. For example: `curl -i -H "Accept: text/csv" -b cookie.txt https://your.mastodon.instance/severed_relationships/<event_id>/followers` where `<event_id>` is an event ID not owned by the logged-in user. Receiving data indicates vulnerability, while a 404 response indicates proper access control. [1, 3, 4]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade Mastodon to a fixed version: v4.3.17, v4.4.11, or v4.5.4 or later. These versions include patches that restrict access to severed relationship events to only those associated with the current authenticated user, preventing unauthorized enumeration of severance events. Until the upgrade can be applied, restrict access to the affected endpoints and monitor for suspicious access patterns. Applying the official patches or updates from Mastodon is the recommended and effective mitigation. [2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthorized access to sensitive relationship data between users, potentially leading to exposure of personal information without proper consent. Such unauthorized disclosure of user relationship data could violate privacy requirements under regulations like GDPR and HIPAA, which mandate strict controls on personal data access and confidentiality. Therefore, the vulnerability negatively impacts compliance by enabling data exposure that should be restricted to the data owner only. [2]