Cyber Resilience

CVE-2026-23961

Access Control in Joinmastodon Mastodon ≤ 4.3.18

Published
22 January 2026
Modified
02 February 2026
Patch / advisory
CVSS Score v3.1 5.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS Score 0.0040 33th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-23961 is a medium-severity Incorrect Authorization (CWE-863) vulnerability in Joinmastodon Mastodon. Its CVSS base score is 5.3 (Medium).

Operationally, ranked at the 33th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-24 (Access Control Decisions) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows server administrators to suspend remote users to prevent interactions. However, some logic errors allow already-known posts from such suspended users to appear in timelines if boosted. Furthermore,…

more

under certain circumstances, previously-unknown posts from suspended users can be processed. This issue allows old posts from suspended users to occasionally end up on timelines on all Mastodon versions. Additionally, on Mastodon versions from v4.5.0 to v4.5.4, v4.4.5 to v4.4.11, v4.3.13 to v4.3.17, and v4.2.26 to v4.2.29, remote suspended users can partially bypass the suspension to get new posts in. Mastodon versions v4.5.5, v4.4.12, v4.3.18 are patched.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

Insufficient information to map techniques.
Confidence: LOW · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-33869Same product: Joinmastodon Mastodon
CVE-2026-23964Same product: Joinmastodon Mastodon
CVE-2023-42451Same product: Joinmastodon Mastodon
CVE-2023-36461Same product: Joinmastodon Mastodon
CVE-2026-22246Same product: Joinmastodon Mastodon
CVE-2026-27477Same product: Joinmastodon Mastodon
CVE-2026-23963Same product: Joinmastodon Mastodon
CVE-2026-25540Same product: Joinmastodon Mastodon
CVE-2023-42452Same product: Joinmastodon Mastodon
CVE-2023-28853Same product: Joinmastodon Mastodon

Affected Assets

joinmastodon
mastodon
≤ 4.3.18 · 4.4.0 — 4.4.12 · 4.5.0 — 4.5.5

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • AC-4 Information Flow Enforcement
  • AC-24 Access Control Decisions
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 5 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces authorization decisions so that content from suspended remote accounts is denied visibility in timelines.

prevent

Enforces information-flow rules that should block posts (boosted or new) originating from suspended accounts from entering local timelines.

prevent

Requires correct access-control decisions to be rendered and honored for every post-ingestion or boost operation involving a suspended actor.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

Defining, enforcing, and reviewing access authorizations and least privilege directly prevents incorrect authorization checks.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Requiring consistency between access rights and classification plus formal approval steps ensures that the authorization logic correctly distinguishes between entities that should and should not be granted access.

prevents

Enforcing policy-driven approval and role-change reviews stops incorrect or stale authorization decisions from remaining in effect after job changes or terminations.

prevents

By tying access rights to identity, device, location and classification, the control reduces the likelihood that an authorization decision will be based on an incorrect or bypassed policy.

References