PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47777 mastodon CVE debrief

CVE-2026-47777 is a HIGH severity vulnerability in Mastodon, a free, open-source social network server. An attacker could bypass the check for remote accounts' consent to be featured in a remote Collection, potentially allowing them to fake consent and manipulate Collection items. This vulnerability affects Mastodon servers running the main branch or nightly builds with the experimental 'Collections' feature enabled. The issue has been patched in version 4.6.0-beta.1.

Vendor
mastodon
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-15
Original CVE updated
2026-06-16
Advisory published
2026-06-15
Advisory updated
2026-06-16

Who should care

Administrators and users of Mastodon servers, especially those running the main branch or nightly builds with the experimental 'Collections' feature enabled.

Technical summary

A missing condition in the check for remote accounts' consent to be featured in a remote Collection could lead to attackers bypassing the check and faking consent. An attacker could forge the FeatureAuthorization object to verify consent to be featured in a Collection, making it appear as if an account is allowed to be in a Collection when it is not.

Defensive priority

HIGH

Recommended defensive actions

  • Update to version 4.6.0-beta.1 or later
  • Disable the experimental 'Collections' feature if not in use
  • Monitor for suspicious activity related to Collection items

Evidence notes

The vulnerability is caused by a missing condition in the check for remote accounts' consent to be featured in a remote Collection. This allows an attacker to forge the FeatureAuthorization object and fake consent.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-47777 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-47777

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-47777 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-47777

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.