CVE-2026-33869

Mastodon has a denial of service for quote authorization

State: Published
Severity: 4.8 Medium
Published: Mar 27, 2026
Updated: Mar 27, 2026
Reserved: Mar 24, 2026

Description

Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.5.x branch prior to 4.5.8 and on the 4.4.x branch prior to 4.4.15, an attacker that knows of a quote before it has reached a server can prevent it from being correctly processed on that server. The vulnerability has been patched in Mastodon 4.5.8 and 4.4.15. Mastodon 4.3 and earlier are not affected because they do not support quotes.

Scores

CVSS	Score	Vector	Source
3.1	4.8 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L	GitHub_M

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
mastodonmastodon	>= 4.5.0, < 4.5.8Affected >= 4.4.0, < 4.4.15Affected

References

https://github.com/mastodon/mastodon/security/advisories/GHSA-q4g8-82c5-9h33

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.