8.2
CVE-2026-41259
- EPSS 0.21%
- Veröffentlicht 23.04.2026 18:55:20
- Zuletzt bearbeitet 28.04.2026 18:50:54
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
LoginMastodon: Insufficient verification of email addresses
Mastodon is a free, open-source social network server based on ActivityPub. Prior to v4.5.9, v4.4.16, and v4.3.22, Mastodon allows restricting new user sign-up based on e-mail domain names, and performs basic validation on e-mail addresses, but fails to restrict characters that are interpreted differently by some mailing servers. This vulnerability is fixed in v4.5.9, v4.4.16, and v4.3.22.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Joinmastodon ≫ Mastodon Version < 4.3.22
Joinmastodon ≫ Mastodon Version >= 4.4.0 < 4.4.16
Joinmastodon ≫ Mastodon Version >= 4.5.0 < 4.5.9
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.21% | 0.114 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
|
| security-advisories@github.com | 8.2 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
CWE-841 Improper Enforcement of Behavioral Workflow
The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.
https://github.com/mastodon/mastodon/security/advisories/GHSA-5r37-qpwq-2jhh