CVE-2026-22246

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon 4.3 added notifications of severed relationships, allowing end-users to inspect the relationships they lost as the result of a moderation action. The code allowing users to download lists of severed relationships for a particular event fails to check the owner of the list before returning the lost relationships. Any registered local user can access the list of lost followers and followed users caused by any severance event, and go through all severance events this way. The leaked information does not include the name of the account which has lost follows and followers. This has been fixed in Mastodon v4.3.17, v4.4.11 and v4.5.4.

• CWE-201

• https://github.com/mastodon/mastodon/commit/68e30985ca7afdb89af1b2e9dc962e1993dc8076Patch
• https://github.com/mastodon/mastodon/commit/b2bcd34486fd6681cc0f30028086ef0f47282adfPatch
• https://github.com/mastodon/mastodon/commit/c1fb6893c5175d74c074f6f786d504c8bc610d57Patch
• https://github.com/mastodon/mastodon/security/advisories/GHSA-ww85-x9cp-5v24Third Party Advisory

Published

Jan 8, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-22240The vulnerability exists in BLUVOYIX due to an improper pass…7.5
• CVE-2026-22241The Open eClass platform (formerly known as GUnet eClass) is…7.2
• CVE-2026-22242CoreShop is a Pimcore enhanced eCommerce solution. Prior to …4.9
• CVE-2026-22243EGroupware is a Web based groupware server written in PHP. A…8.8
• CVE-2026-22244OpenMetadata is a unified metadata platform. Versions prior …7.2
• CVE-2026-22245Mastodon is a free, open-source social network server based …7.5
• CVE-2026-22247GLPI is a free asset and IT management software package. Fro…9.1
• CVE-2026-22248GLPI is an open-source asset and IT management software pack…8.8
• CVE-2026-22249Docmost is an open-source collaborative wiki and documentati…9.8
• CVE-2026-2225A flaw has been found in itsourcecode News Portal Project 1.…9.8
• CVE-2026-22250wlc is a Weblate command-line client using Weblate's REST AP…5.5
• CVE-2026-22251wlc is a Weblate command-line client using Weblate's REST AP…5.5