CVE-2026-23964

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23964", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-19T14:49:06.313Z", "datePublished": "2026-01-22T01:55:29.904Z", "dateUpdated": "2026-01-22T17:02:23.614Z"}, "containers": {"cna": {"title": "Mastodon has insufficient access control to push notification settings", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/mastodon/mastodon/security/advisories/GHSA-f3q8-7vw3-69v4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-f3q8-7vw3-69v4"}, {"name": "https://github.com/mastodon/mastodon/releases/tag/v4.3.18", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.3.18"}, {"name": "https://github.com/mastodon/mastodon/releases/tag/v4.4.12", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.4.12"}, {"name": "https://github.com/mastodon/mastodon/releases/tag/v4.5.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.5.5"}], "affected": [{"vendor": "mastodon", "product": "mastodon", "versions": [{"version": "< 4.3.18", "status": "affected"}, {"version": ">= 4.4.0, < 4.4.12", "status": "affected"}, {"version": ">= 4.5.0, < 4.5.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T01:55:29.904Z"}, "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, an insecure direct object reference in the web push subscription update endpoint lets any authenticated user update another user's push subscription by guessing or obtaining the numeric subscription id. This can be used to disrupt push notifications for other users and also leaks the web push subscription endpoint. Any user with a web push subscription is impacted, because another authenticated user can tamper with their push subscription settings if they can guess or obtain the subscription id. This allows an attacker to disrupt push notifications by changing the policy (whether to filter notifications from non-followers or non-followed users) and subscribed notification types of their victims. Additionally, the endpoint returns the subscription object, which includes the push notification endpoint for this subscription, but not its keypair. Mastodon versions v4.5.5, v4.4.12, v4.3.18 are patched."}], "source": {"advisory": "GHSA-f3q8-7vw3-69v4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-22T16:55:30.907556Z", "id": "CVE-2026-23964", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T17:02:23.614Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23964", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-22T16:55:30.907556Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T17:02:19.354Z"}}], "cna": {"title": "Mastodon has insufficient access control to push notification settings", "source": {"advisory": "GHSA-f3q8-7vw3-69v4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "mastodon", "product": "mastodon", "versions": [{"status": "affected", "version": "< 4.3.18"}, {"status": "affected", "version": ">= 4.4.0, < 4.4.12"}, {"status": "affected", "version": ">= 4.5.0, < 4.5.5"}]}], "references": [{"url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-f3q8-7vw3-69v4", "name": "https://github.com/mastodon/mastodon/security/advisories/GHSA-f3q8-7vw3-69v4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/mastodon/mastodon/releases/tag/v4.3.18", "name": "https://github.com/mastodon/mastodon/releases/tag/v4.3.18", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mastodon/mastodon/releases/tag/v4.4.12", "name": "https://github.com/mastodon/mastodon/releases/tag/v4.4.12", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mastodon/mastodon/releases/tag/v4.5.5", "name": "https://github.com/mastodon/mastodon/releases/tag/v4.5.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, an insecure direct object reference in the web push subscription update endpoint lets any authenticated user update another user's push subscription by guessing or obtaining the numeric subscription id. This can be used to disrupt push notifications for other users and also leaks the web push subscription endpoint. Any user with a web push subscription is impacted, because another authenticated user can tamper with their push subscription settings if they can guess or obtain the subscription id. This allows an attacker to disrupt push notifications by changing the policy (whether to filter notifications from non-followers or non-followed users) and subscribed notification types of their victims. Additionally, the endpoint returns the subscription object, which includes the push notification endpoint for this subscription, but not its keypair. Mastodon versions v4.5.5, v4.4.12, v4.3.18 are patched."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T01:55:29.904Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23964", "state": "PUBLISHED", "dateUpdated": "2026-01-22T17:02:23.614Z", "dateReserved": "2026-01-19T14:49:06.313Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-22T01:55:29.904Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mastodon", "vendor": "mastodon", "versions": [{"status": "affected", "version": "< 4.3.18"}, {"status": "affected", "version": ">= 4.4.0, < 4.4.12"}, {"status": "affected", "version": ">= 4.5.0, < 4.5.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*", "matchCriteriaId": "0ADDA491-E534-4DFB-856F-9D07F38F3A92", "versionEndExcluding": "4.3.18", "vulnerable": true}, {"criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*", "matchCriteriaId": "9BAA2A25-EE70-4B9F-8848-2CCE9C243077", "versionEndExcluding": "4.4.12", "versionStartIncluding": "4.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*", "matchCriteriaId": "71845808-53CF-46D1-9A12-F14F1BAED488", "versionEndExcluding": "4.5.5", "versionStartIncluding": "4.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, an insecure direct object reference in the web push subscription update endpoint lets any authenticated user update another user's push subscription by guessing or obtaining the numeric subscription id. This can be used to disrupt push notifications for other users and also leaks the web push subscription endpoint. Any user with a web push subscription is impacted, because another authenticated user can tamper with their push subscription settings if they can guess or obtain the subscription id. This allows an attacker to disrupt push notifications by changing the policy (whether to filter notifications from non-followers or non-followed users) and subscribed notification types of their victims. Additionally, the endpoint returns the subscription object, which includes the push notification endpoint for this subscription, but not its keypair. Mastodon versions v4.5.5, v4.4.12, v4.3.18 are patched."}, {"lang": "es", "value": "Mastodon es un servidor de red social gratuito y de c\u00f3digo abierto basado en ActivityPub. Antes de las versiones 4.5.5, 4.4.12 y 4.3.18, una referencia directa a objeto insegura en el endpoint de actualizaci\u00f3n de suscripci\u00f3n de notificaciones push web permite a cualquier usuario autenticado actualizar la suscripci\u00f3n de notificaciones push de otro usuario adivinando u obteniendo el ID num\u00e9rico de la suscripci\u00f3n. Esto puede usarse para interrumpir las notificaciones push de otros usuarios y tambi\u00e9n filtra el endpoint de suscripci\u00f3n de notificaciones push web. Cualquier usuario con una suscripci\u00f3n de notificaciones push web se ve afectado, porque otro usuario autenticado puede manipular la configuraci\u00f3n de su suscripci\u00f3n de notificaciones push si puede adivinar u obtener el ID de la suscripci\u00f3n. Esto permite a un atacante interrumpir las notificaciones push cambiando la pol\u00edtica (si filtrar notificaciones de usuarios no seguidores o no seguidos) y los tipos de notificaci\u00f3n suscritos de sus v\u00edctimas. Adem\u00e1s, el endpoint devuelve el objeto de suscripci\u00f3n, que incluye el endpoint de notificaci\u00f3n push para esta suscripci\u00f3n, pero no su par de claves. Las versiones de Mastodon v4.5.5, v4.4.12, v4.3.18 est\u00e1n parcheadas."}], "id": "CVE-2026-23964", "lastModified": "2026-06-17T10:22:21.873", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23964", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-22T16:55:30.907556Z", "version": "2.0.3"}}]}, "published": "2026-01-22T03:15:46.700", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.3.18"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.4.12"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.5.5"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-f3q8-7vw3-69v4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-639"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T03:59:09.905017+00:00", "value": {"mitigation_remediation": ["Upgrade to the patched releases of Mastodon (v4.5.5 or later, or v4.4.12 or v4.3.18) as soon as possible.", "Ensure that only the owner of a subscription can access the update endpoint, and remove or obfuscate the numeric subscription ID in public contexts to mitigate ID guessing.", "Enable audit logging and monitor for unauthorized push subscription changes so that anomalous activity can be detected and investigated promptly."], "summary": {"action": "Patch", "impact": "Unauthorized Modification of User Notification Settings and Information Disclosure"}, "threat_synthesis": {"affected_systems": "Mastodon servers running versions earlier than 4.3.18, 4.4.12, or 4.5.5 are vulnerable. Any user who has a web push subscription is potentially at risk because other authenticated users can guess or obtain subscription identifiers and modify their settings.", "description_and_impact": "Mastodon, a decentralized social network server, contains an insecure direct object reference that permits any authenticated user to alter another user's web push subscription settings when the numeric subscription ID is known. This flaw allows an attacker to disrupt or modify the delivery policy of a victim's push notifications and to leak the subscription endpoint to the attacker. The weakness is rooted in improper access control over the subscription object and is classified under CWE\u2011639 and CWE\u2011863.", "risk_and_exploitability": "The flaw requires the attacker to be authenticated to the Mastodon instance and to guess or otherwise acquire a subscription ID, so it is not publicly exploitable. The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but the impact can be significant for users relying on push notifications. Given the moderate severity and access requirement, the overall risk for impacted servers is moderate."}}}}, "created": "2026-01-22T10:08:04.676535+00:00", "updated": "2026-04-18T04:00:08.425565+00:00", "vendors": ["joinmastodon", "joinmastodon$PRODUCT$mastodon"]}