CVE-2026-41259

Mastodon: Insufficient verification of email addresses

State: Published
Severity: 8.2 High
Published: Apr 23, 2026
Updated: Apr 23, 2026
Reserved: Apr 18, 2026

Description

Mastodon is a free, open-source social network server based on ActivityPub. Prior to v4.5.9, v4.4.16, and v4.3.22, Mastodon allows restricting new user sign-up based on e-mail domain names, and performs basic validation on e-mail addresses, but fails to restrict characters that are interpreted differently by some mailing servers. This vulnerability is fixed in v4.5.9, v4.4.16, and v4.3.22.

Scores

CVSS	Score	Vector	Source
4.0	8.2 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-841 Improper Enforcement of Behavioral Workflow

Affected Products

Product	Versions
mastodonmastodon	< 4.3.22Affected >= 4.4.0-beta.1, < 4.4.16Affected >= 4.5.0-beta.1, < 4.5.9Affected

References

https://github.com/mastodon/mastodon/security/advisories/GHSA-5r37-qpwq-2jhh

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.