CVE-2026-23961
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-02-02
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| joinmastodon | mastodon | to 4.3.18 (exc) |
| joinmastodon | mastodon | From 4.4.0 (inc) to 4.4.12 (exc) |
| joinmastodon | mastodon | From 4.5.0 (inc) to 4.5.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Mastodon allows suspended remote users to bypass suspension restrictions. Due to logic errors, posts from suspended users can still appear in timelines. Known posts from suspended users may show up if boosted, and under certain conditions, new posts from suspended users can also be processed and displayed. This means that suspension does not fully prevent a remote user from having their posts visible on timelines in affected versions. [2]
How can this vulnerability impact me? :
The impact of this vulnerability is that suspended remote users can partially bypass suspension controls, causing their posts to appear in timelines despite being suspended. This compromises the integrity of the social network's moderation by allowing unauthorized content to be visible. However, confidentiality and availability are not affected. The presence of unauthorized posts can undermine trust in the platform's suspension mechanisms. [2]
What immediate steps should I take to mitigate this vulnerability?
To mitigate CVE-2026-23961, immediately upgrade your Mastodon instance to a patched version: v4.3.18, v4.4.12, or v4.5.5. Before upgrading, back up your databases. After upgrading, restart all Mastodon processes. Follow the upgrade instructions specific to your deployment environment, including asset recompilation if required. These steps will fix the remote user suspension bypass vulnerability and related issues. [1, 3, 4]