CVE-2026-23964

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, an insecure direct object reference in the web push subscription update endpoint lets any authenticated user update another user's push subscription by guessing or obtaining the numeric subscription id. This can be used to disrupt push notifications for other users and also leaks the web push subscription endpoint. Any user with a web push subscription is impacted, because another authenticated user can tamper with their push subscription settings if they can guess or obtain the subscription id. This allows an attacker to disrupt push notifications by changing the policy (whether to filter notifications from non-followers or non-followed users) and subscribed notification types of their victims. Additionally, the endpoint returns the subscription object, which includes the push notification endpoint for this subscription, but not its keypair. Mastodon versions v4.5.5, v4.4.12, v4.3.18 are patched.

• CWE-863
• CWE-639

• https://github.com/mastodon/mastodon/releases/tag/v4.3.18Release Notes
• https://github.com/mastodon/mastodon/releases/tag/v4.4.12Release Notes
• https://github.com/mastodon/mastodon/releases/tag/v4.5.5Release Notes
• https://github.com/mastodon/mastodon/security/advisories/GHSA-f3q8-7vw3-69v4Vendor Advisory

Published

Jan 22, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23959CoreShop is a Pimcore enhanced eCommerce solution. An error-…4.9
• CVE-2026-2396The List View Google Calendar plugin for WordPress is vulner…4.4
• CVE-2026-23960Argo Workflows is an open source container-native workflow e…5.4
• CVE-2026-23961Mastodon is a free, open-source social network server based …5.3
• CVE-2026-23962Mastodon is a free, open-source social network server based …7.5
• CVE-2026-23963Mastodon is a free, open-source social network server based …6.5
• CVE-2026-23965sm-crypto provides JavaScript implementations of the Chinese…7.5
• CVE-2026-23966sm-crypto provides JavaScript implementations of the Chinese…9.1
• CVE-2026-23967sm-crypto provides JavaScript implementations of the Chinese…7.5
• CVE-2026-23968Copier is a library and CLI app for rendering project templa…5.5
• CVE-2026-23969Apache Superset utilizes a configurable dictionary, DISALLOW…6.5
• CVE-2026-2397Improper neutralization of special elements used in an SQL c…9.8