CVE-2026-41259
Joinmastodon Mastodon ≤ 4.3.22
Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-41259 is a high-severity Improper Enforcement of Behavioral Workflow (CWE-841) vulnerability in Joinmastodon Mastodon. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique External Remote Services (T1133); ranked at the 12th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and IA-11 (Re-authentication) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-41259 is a vulnerability in Mastodon, a free, open-source social network server based on ActivityPub. It affects versions prior to 4.5.9, 4.4.16, and 4.3.22. Mastodon supports restricting new user sign-ups based on email domain names and includes basic email address validation, but it does not restrict certain characters that some mailing servers interpret differently. This flaw, rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and mapped to CWE-841, enables improper enforcement of email domain restrictions.
Unauthenticated remote attackers can exploit this during the sign-up process by submitting email addresses with specially crafted characters. These characters may be normalized or altered by certain mail servers, allowing attackers to bypass intended domain-based restrictions such as blacklists or whitelists. Successful exploitation results in unauthorized account creation, compromising the integrity of access controls on affected Mastodon instances.
The official Mastodon security advisory (GHSA-5r37-qpwq-2jhh) at https://github.com/mastodon/mastodon/security/advisories/GHSA-5r37-qpwq-2jhh confirms the issue and states that it is fixed in versions 4.5.9, 4.4.16, and 4.3.22. Security practitioners should prioritize upgrading to these patched releases to mitigate the vulnerability.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25282
Vulnerability Data
Mastodon is a free, open-source social network server based on ActivityPub. Prior to v4.5.9, v4.4.16, and v4.3.22, Mastodon allows restricting new user sign-up based on e-mail domain names, and performs basic validation on e-mail addresses, but fails to restrict characters…
more
that are interpreted differently by some mailing servers. This vulnerability is fixed in v4.5.9, v4.4.16, and v4.3.22.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V7.2.1
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement can require each successive workflow step to present the proper authorization context before proceeding.
Re-authentication requirements can be placed at critical workflow steps to ensure the actor has performed prior behaviors.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure development practices directly address proper workflow enforcement during design and coding.
Enforcing authorization policies can include sequence constraints on multi-step actions.
Hardened configuration baselines can embed required workflow ordering rules.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect workflow bypasses but does not enforce them at runtime.
Secure development lifecycle requires explicit workflow enforcement in multi-step processes.
Application security requirements include sequencing and state-transition rules for critical workflows.
Secure architecture principles address proper ordering of security-critical operations.
Secure coding practices can prevent missing workflow checks but do not define the control itself.
Change management can require workflow adherence for changes but is not the primary mitigation.