CVE-2026-72915
Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access personally identifying information about another local user in a collection because the controller used the general collection policy instead of the admin collection policy namespace. The exposed data included the other user's current email address and last-used IP address. This issue is fixed in versions 4.6.4 and 4.7.0-beta.1.
Schwachstellenklasse
Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access personally identifying information about another local user in a collection because the controller used the general collection policy instead of the admin collection policy namespace. The exposed data included the other user's current email address and last-used IP address. This issue is fixed in versions 4.6.4 and 4.7.0-beta.1.
Quellen
- https://github.com/mastodon/mastodon/commit/467c933459c7d0e5513475b9e4888afaedfb1074
- https://github.com/mastodon/mastodon/commit/930aa9fee26bf9eaefe27826fa1061288d83373b
- https://github.com/mastodon/mastodon/releases/tag/v4.6.4
- https://github.com/mastodon/mastodon/releases/tag/v4.7.0-beta.1
- https://github.com/mastodon/mastodon/security/advisories/GHSA-hx34-2pfw-2qfj
Finden Sie die Schwachstelle, bevor es ein Angreifer tut.
Melden Sie sich mit GitHub an und starten Sie Ihr erstes Audit in weniger als einer Minute. Für den kostenlosen Plan ist keine Kreditkarte nötig.