Description

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access personally identifying information about another local user in a collection because the controller used the general collection policy instead of the admin collection policy namespace. The exposed data included the other user's current email address and last-used IP address. This issue is fixed in versions 4.6.4 and 4.7.0-beta.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-10T22:17:10.360Z",
  "pubdate": "2026-08-10T22:17:10.360Z",
  "executiveSummary": "An authorization bypass vulnerability exists within the Mastodon admin collections controller, specifically affecting local user data retrieval. The flaw allows any authenticated local user to leverage the show action to access sensitive personally identifying information belonging to other local users within a collection. The root cause stems from the application utilizing the general collection policy rather than enforcing the appropriate administrative collection policy namespace. Exploitation of this vulnerability results in the unauthorized exposure of critical user data, including current email addresses and last-used IP addresses. The risk implications include severe privacy violations and potential targeting of users based on leaked telemetry. The capability required by an attacker is limited to standard authenticated local user privileges, meaning no specialized administrative access is initially necessary. The vulnerability affects Mastodon versions from 4.6.0-beta.1 through 4.6.4 and 4.7.0-beta.1, and is resolved in versions 4.6.4 and 4.7.0-beta.1.",
  "technicalDetails": "The vulnerability resides in the Mastodon codebase, specifically within the vulnerable component located at app/controllers/admin/collections_controller.rb. The root cause of the security defect is an improper authorization check implementation within the show action. During request handling, the controller incorrectly delegates authorization decisions to the general collection policy instead of enforcing the strict admin collection policy namespace. Consequently, the access control layer fails to verify whether the requesting user possesses administrative privileges before returning serialized collection data. To exploit this vulnerability, an attacker must first authenticate as a standard local user within the Mastodon instance, satisfying the initial authentication requirement. The attack flow initiates when the malicious actor sends a crafted HTTP request directly to the show action endpoint within the admin collections controller. Due to the flawed authorization logic, the application processes the request without validating administrative role assignments. The backend controller queries the database and compiles a response containing sensitive user attributes. The payload behavior involves the retrieval and exposure of restricted Personally Identifiable Information, specifically capturing the targeted user's current email address and last-used IP address. The post-exploitation impact includes unauthorized telemetry harvesting and internal reconnaissance, enabling the local attacker to map other local accounts and gather confidential metadata associated with targeted instances or users. The vulnerability affects Mastodon versions 4.6.0-beta.1 through 4.6.4 and 4.7.0-beta.1."
}