CVE-2026-48028

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, Mastodon's normalization of incoming activities signed with Linked-Data Signatures does not sufficiently protect the activities from a certain class of spoofing, allowing threat actors to remove JSON entries from valid signed activities from a third-party actor. This vulnerability is fixed in 4.5.10, 4.4.17, and 4.3.23.

Scoring

Severity

MEDIUM

CVSS base score

6.5

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

EPSS probability

0.18%

CWE

CWE-354

Published

2026-06-24

Last modified

2026-06-25

Affected products

• mastodon mastodon
• mastodon mastodon
• mastodon mastodon

Weakness type

• CWE-354

Related vulnerabilities

• CVE-2026-72929 — Windows Installer Elevation of Privilege Vulnerability
• CVE-2026-20354 — Cisco Secure Email S/MIME Ciphertext Decryption Vulnerabilty
• CVE-2026-82549 — Linux Foundation Magma SecurityModeComplete integrity check
• CVE-2026-75803 — AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()
• CVE-2026-75625 — Kraken Agents Peer-to-Peer Download Cache Poisoning via Digest Verification Bypass
• CVE-2026-12817 — OpenPGP AEAD decryption skips final tag on chunk-aligned data
• CVE-2026-12816 — IESEngine stream-mode MAC forgery via length-dependent KDF split
• CVE-2026-12803 — KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery)

Markdown version · Browse all CVEs