CVE-2026-22246

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22246", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-07T05:19:12.921Z", "datePublished": "2026-01-08T15:27:21.490Z", "dateUpdated": "2026-01-08T15:54:24.770Z"}, "containers": {"cna": {"title": "Local Mastodon users can enumerate and access severed relationships of every other local user", "problemTypes": [{"descriptions": [{"cweId": "CWE-201", "lang": "en", "description": "CWE-201: Insertion of Sensitive Information Into Sent Data", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/mastodon/mastodon/security/advisories/GHSA-ww85-x9cp-5v24", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-ww85-x9cp-5v24"}, {"name": "https://github.com/mastodon/mastodon/commit/68e30985ca7afdb89af1b2e9dc962e1993dc8076", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/commit/68e30985ca7afdb89af1b2e9dc962e1993dc8076"}, {"name": "https://github.com/mastodon/mastodon/commit/b2bcd34486fd6681cc0f30028086ef0f47282adf", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/commit/b2bcd34486fd6681cc0f30028086ef0f47282adf"}, {"name": "https://github.com/mastodon/mastodon/commit/c1fb6893c5175d74c074f6f786d504c8bc610d57", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/commit/c1fb6893c5175d74c074f6f786d504c8bc610d57"}], "affected": [{"vendor": "mastodon", "product": "mastodon", "versions": [{"version": "< 4.3.17", "status": "affected"}, {"version": ">= 4.4.0-beta.1, < 4.4.11", "status": "affected"}, {"version": ">= 4.5.0-beta.1, < 4.5.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-08T15:27:21.490Z"}, "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. Mastodon 4.3 added notifications of severed relationships, allowing end-users to inspect the relationships they lost as the result of a moderation action. The code allowing users to download lists of severed relationships for a particular event fails to check the owner of the list before returning the lost relationships. Any registered local user can access the list of lost followers and followed users caused by any severance event, and go through all severance events this way. The leaked information does not include the name of the account which has lost follows and followers. This has been fixed in Mastodon v4.3.17, v4.4.11 and v4.5.4."}], "source": {"advisory": "GHSA-ww85-x9cp-5v24", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-08T15:51:57.907032Z", "id": "CVE-2026-22246", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T15:54:24.770Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22246", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-08T15:51:57.907032Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T15:52:01.399Z"}}], "cna": {"title": "Local Mastodon users can enumerate and access severed relationships of every other local user", "source": {"advisory": "GHSA-ww85-x9cp-5v24", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "mastodon", "product": "mastodon", "versions": [{"status": "affected", "version": "< 4.3.17"}, {"status": "affected", "version": ">= 4.4.0-beta.1, < 4.4.11"}, {"status": "affected", "version": ">= 4.5.0-beta.1, < 4.5.4"}]}], "references": [{"url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-ww85-x9cp-5v24", "name": "https://github.com/mastodon/mastodon/security/advisories/GHSA-ww85-x9cp-5v24", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/mastodon/mastodon/commit/68e30985ca7afdb89af1b2e9dc962e1993dc8076", "name": "https://github.com/mastodon/mastodon/commit/68e30985ca7afdb89af1b2e9dc962e1993dc8076", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mastodon/mastodon/commit/b2bcd34486fd6681cc0f30028086ef0f47282adf", "name": "https://github.com/mastodon/mastodon/commit/b2bcd34486fd6681cc0f30028086ef0f47282adf", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mastodon/mastodon/commit/c1fb6893c5175d74c074f6f786d504c8bc610d57", "name": "https://github.com/mastodon/mastodon/commit/c1fb6893c5175d74c074f6f786d504c8bc610d57", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. Mastodon 4.3 added notifications of severed relationships, allowing end-users to inspect the relationships they lost as the result of a moderation action. The code allowing users to download lists of severed relationships for a particular event fails to check the owner of the list before returning the lost relationships. Any registered local user can access the list of lost followers and followed users caused by any severance event, and go through all severance events this way. The leaked information does not include the name of the account which has lost follows and followers. This has been fixed in Mastodon v4.3.17, v4.4.11 and v4.5.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-201", "description": "CWE-201: Insertion of Sensitive Information Into Sent Data"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-08T15:27:21.490Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22246", "state": "PUBLISHED", "dateUpdated": "2026-01-08T15:54:24.770Z", "dateReserved": "2026-01-07T05:19:12.921Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-08T15:27:21.490Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mastodon", "vendor": "mastodon", "versions": [{"status": "affected", "version": "< 4.3.17"}, {"status": "affected", "version": ">= 4.4.0-beta.1, < 4.4.11"}, {"status": "affected", "version": ">= 4.5.0-beta.1, < 4.5.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*", "matchCriteriaId": "6B2706E5-A6D0-4790-A3E6-5DE023465AB2", "versionEndExcluding": "4.3.17", "vulnerable": true}, {"criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*", "matchCriteriaId": "DD92863A-CB76-45AA-BF4D-9870B24E8109", "versionEndExcluding": "4.4.11", "versionStartIncluding": "4.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*", "matchCriteriaId": "3E8FBAF5-C7BC-4980-9780-50BA935D126B", "versionEndExcluding": "4.5.4", "versionStartIncluding": "4.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. Mastodon 4.3 added notifications of severed relationships, allowing end-users to inspect the relationships they lost as the result of a moderation action. The code allowing users to download lists of severed relationships for a particular event fails to check the owner of the list before returning the lost relationships. Any registered local user can access the list of lost followers and followed users caused by any severance event, and go through all severance events this way. The leaked information does not include the name of the account which has lost follows and followers. This has been fixed in Mastodon v4.3.17, v4.4.11 and v4.5.4."}, {"lang": "es", "value": "Mastodon es un servidor de red social gratuito, de c\u00f3digo abierto, basado en ActivityPub. Mastodon 4.3 a\u00f1adi\u00f3 notificaciones de relaciones cortadas, permitiendo a los usuarios finales inspeccionar las relaciones que perdieron como resultado de una acci\u00f3n de moderaci\u00f3n. El c\u00f3digo que permite a los usuarios descargar listas de relaciones cortadas para un evento particular no verifica al propietario de la lista antes de devolver las relaciones perdidas. Cualquier usuario local registrado puede acceder a la lista de seguidores perdidos y usuarios seguidos causada por cualquier evento de corte, y revisar todos los eventos de corte de esta manera. La informaci\u00f3n filtrada no incluye el nombre de la cuenta que ha perdido seguimientos y seguidores. Esto ha sido corregido en Mastodon v4.3.17, v4.4.11 y v4.5.4."}], "id": "CVE-2026-22246", "lastModified": "2026-06-17T10:19:37.690", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22246", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-08T15:51:57.907032Z", "version": "2.0.3"}}]}, "published": "2026-01-08T16:16:02.957", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/mastodon/mastodon/commit/68e30985ca7afdb89af1b2e9dc962e1993dc8076"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/mastodon/mastodon/commit/b2bcd34486fd6681cc0f30028086ef0f47282adf"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/mastodon/mastodon/commit/c1fb6893c5175d74c074f6f786d504c8bc610d57"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-ww85-x9cp-5v24"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-201"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T16:43:42.507782+00:00", "value": {"mitigation_remediation": ["Upgrade Mastodon to v4.3.17 or newer (v4.4.11, v4.5.4).", "If an immediate upgrade is not feasible, temporarily disable the severed relationship notifications feature or block API access to the severance event endpoint through configuration settings.", "Conduct an audit of API activity logs for unusual enumeration of severed relationships and restrict local user permissions to the severed relationship API endpoint."], "summary": {"action": "Immediate Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "Mastodon servers running the free, open\u2011source social network software, specifically versions 4.3 through 4.3.16, 4.4.0\u20134.4.10, and 4.5.0\u20134.5.3 are affected. The issue is resolved in Mastodon v4.3.17, v4.4.11, and v4.5.4. Any registered local user on a vulnerable instance can exploit the flaw.", "description_and_impact": "The vulnerability allows a registered local user to retrieve the list of users that were lost followers or followed as a result of any severance event. Although the account name that lost follows or followers is not disclosed, the attack reveals the scope of the moderation action, leaking sensitive user relationship data. The flaw is a failure to enforce proper ownership checks on the severed relationship download API, corresponding to CWE-201 (Access Control Failure).", "risk_and_exploitability": "The CVSS score is 6.5, indicating moderate severity. EPSS is below 1%, showing a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only local access to the server\u2019s API and does not rely on remote code execution or elevated privileges, making it relatively straightforward for an authenticated user to enumerate severance events."}}}}, "created": "2026-01-09T13:24:44.437931+00:00", "updated": "2026-04-18T16:45:05.231134+00:00", "vendors": ["joinmastodon", "joinmastodon$PRODUCT$mastodon"]}