CVE-2026-72915 mastodon CVE debrief

Who should care

Defenders responsible for Mastodon instances, particularly those with local user access, should assess exposure and apply patches to prevent potential misuse of sensitive information.

Why it matters

CVE-2026-72915 is a high-severity vulnerability in Mastodon that allows logged-in local users to access sensitive information about other local users. Defenders should prioritize verifying exposure, applying patches, and monitoring for potential security incidents.

• Verify exposure of sensitive user information.
• Apply patches to prevent potential misuse of email addresses and IP addresses.
• Monitor for potential security incidents related to accessed user data.
• Assess local user access and permissions on Mastodon instances.

Technical summary

The vulnerability in Mastodon allows logged-in local users to access personally identifying information about another local user in a collection due to a policy issue in the app/controllers/admin/collections_controller.rb file. The exposed data includes the other user's current email address and last-used IP address. This issue arises from the use of the general collection policy instead of the admin collection policy namespace, affecting versions from 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1. Defenders should prioritize verifying exposure and applying patches to Mastodon instances, particularly those with local user access, to prevent potential misuse of sensitive information.

Defensive priority

Defenders should prioritize verifying exposure and applying patches to Mastodon instances, particularly those with local user access.

Recommended defensive actions

• Verify Mastodon instance versions and apply patches to 4.6.4 or 4.7.0-beta.1 if necessary.
• Review local user access and permissions on Mastodon instances.
• Monitor for potential misuse of accessed email addresses and IP addresses.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed versions. However, additional information on potential exploitation or victim impact is limited. Defenders should verify exposure by reviewing Mastodon instance versions, checking for local user access, and monitoring for potential misuse of accessed email addresses and IP addresses. Evidence from the CVE Program and NVD suggests that the vulnerability is high-severity, but further details on exploitation are not available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.