What’s Vulnerable › Vulnerabilities
CVE-2026-41259: Mastodon: Insufficient verification of email addresses
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-04-23 · updated 2026-06-17
- Weakness: CWE-841
Description
Mastodon is a free, open-source social network server based on ActivityPub. Prior to v4.5.9, v4.4.16, and v4.3.22, Mastodon allows restricting new user sign-up based on e-mail domain names, and performs basic validation on e-mail addresses, but fails to restrict characters that are interpreted differently by some mailing servers. This vulnerability is fixed in v4.5.9, v4.4.16, and v4.3.22.
Affected products
- mastodon: before 4.3.22; from 4.4.0 before 4.4.16; from 4.5.0 before 4.5.9 — fixed in 4.3.22, 4.4.16, 4.5.9
How to fix
Upgrade to a fixed version: mastodon 4.3.22, 4.4.16, 4.5.9. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-41259 or the next vulnerability affects your stack