{"id":"CVE-2026-72915","aliases":["BIT-mastodon-2026-72915","EUVD-2026-55838","GHSA-hx34-2pfw-2qfj"],"status":"published","title":"Mastodon: Personally-identifying information disclosure due to incorrect access control validation","description":"Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access personally identifying information about another local user in a collection because the controller used the general collection policy instead of the admin collection policy namespace. The exposed data included the other user's current email address and last-used IP address. This issue is fixed in versions 4.6.4 and 4.7.0-beta.1.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00483,"percentile":0.42151,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2026-08-10T21:16:19Z","modified":"2026-10-28T02:31:13Z","fixes":[{"ecosystem":"Bitnami","package":"mastodon","fixed_in":["4.6.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"mastodon","ranges":[{"type":"SEMVER","events":[{"introduced":"4.6.0"},{"fixed":"4.6.4"}]}]}],"products":[{"vendor":"mastodon","product":"mastodon"}],"references":[{"url":"https://github.com/mastodon/mastodon/security/advisories/GHSA-hx34-2pfw-2qfj","tags":["x_refsource_CONFIRM","web","advisory"]},{"url":"https://github.com/mastodon/mastodon/commit/467c933459c7d0e5513475b9e4888afaedfb1074","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/mastodon/mastodon/commit/930aa9fee26bf9eaefe27826fa1061288d83373b","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/mastodon/mastodon/releases/tag/v4.6.4","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/mastodon/mastodon/releases/tag/v4.7.0-beta.1","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72915","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72915.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-72915","title":"Mastodon: Personally-identifying information disclosure due to incorrect access control validation","description":"Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access personally identifying information about another local user in a collection because the controller used the general collection policy instead of the admin collection policy namespace. The exposed data included the other user's current email address and last-used IP address. This issue is fixed in versions 4.6.4 and 4.7.0-beta.1.","status":"published","published":"2026-08-10T21:16:19.82Z","modified":"2026-08-11T17:09:10.053Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:19:52.016971Z"}],"euvd":[{"id":"EUVD-2026-55838","description":"Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access personally identifying information about another local user in a collection because the controller used the general collection policy instead of the admin collection policy namespace. The exposed data included the other user's current email address and last-used IP address. This issue is fixed in versions 4.6.4 and 4.7.0-beta.1.","status":"published","published":"2026-08-10T21:16:19Z","modified":"2026-08-11T17:09:10Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:59.481615Z"}],"nvd":[{"id":"CVE-2026-72915","description":"Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access personally identifying information about another local user in a collection because the controller used the general collection policy instead of the admin collection policy namespace. The exposed data included the other user's current email address and last-used IP address. This issue is fixed in versions 4.6.4 and 4.7.0-beta.1.","status":"published","published":"2026-08-10T22:17:10.36Z","modified":"2026-09-09T20:55:04.493Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:36.102748Z"}],"osv":[{"id":"CVE-2026-72915","title":"Mastodon: Personally-identifying information disclosure due to incorrect access control validation","description":"Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access personally identifying information about another local user in a collection because the controller used the general collection policy instead of the admin collection policy namespace. The exposed data included the other user's current email address and last-used IP address. This issue is fixed in versions 4.6.4 and 4.7.0-beta.1.","status":"published","published":"2026-08-10T21:16:19.82Z","modified":"2026-10-28T02:31:13.473425217Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:45:15.88521Z"},{"id":"BIT-mastodon-2026-72915","title":"Mastodon: Personally-identifying information disclosure due to incorrect access control validation","description":"Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0 until 4.6.4 and 4.7.0, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access personally identifying information about another local user in a collection because the controller used the general collection policy instead of the admin collection policy namespace. The exposed data included the other user's current email address and last-used IP address. This issue is fixed in versions 4.6.4 and 4.7.0.","status":"published","published":"2026-08-17T05:46:38.079Z","modified":"2026-08-17T08:10:34.823291698Z","updated_at":"2026-11-02T15:28:33.072289Z"}]}}