CVE-2026-72915: Mastodon Information Disclosure Flaw

CVE-2026-72915 Overview

CVE-2026-72915 is an information disclosure vulnerability in Mastodon, the open-source federated social network server based on ActivityPub. The flaw affects versions from 4.6.0-beta.1 up to 4.6.4 and 4.7.0-beta.1. Any authenticated local user can invoke the show action in app/controllers/admin/collections_controller.rb to retrieve personally identifying information about other local users. The controller applied the general collection policy rather than the admin collection policy namespace, allowing non-admin accounts to view another user's email address and last-used IP address. The weakness is classified under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Authenticated non-admin users can retrieve email addresses and last-used IP addresses of other local Mastodon users through the admin collections endpoint, exposing PII across the instance.

Affected Products

Mastodon 4.6.0-beta.1 through 4.6.3
Mastodon 4.7.0-beta.1 (pre-fix builds)
Self-hosted Mastodon instances running affected versions

Discovery Timeline

2026-08-10 - CVE-2026-72915 published to NVD
2026-08-11 - Last updated in NVD database
Fixed in - Mastodon 4.6.4 and 4.7.0-beta.1

Technical Details for CVE-2026-72915

Vulnerability Analysis

The vulnerability resides in the show action of app/controllers/admin/collections_controller.rb. Mastodon uses Pundit-style authorization policies to gate access to administrative resources. Admin controllers must scope authorization calls with the :admin namespace so that Pundit resolves to Admin::CollectionPolicy instead of the general CollectionPolicy. The affected code invoked authorize @collection, :show? without the admin namespace, causing Pundit to evaluate the general collection policy that permits any logged-in user. This authorization mismatch allowed non-admin authenticated users to reach an admin endpoint that returns sensitive account fields, including email and sign_in_ip.

Root Cause

The root cause is a missing authorization namespace on a Pundit authorize call inside an admin controller. Without the [:admin, @collection] scope, Pundit selects the less restrictive policy class and authorizes any authenticated session. This is a broken access control defect rather than an input validation flaw.

Attack Vector

Exploitation requires only a valid local account on a vulnerable Mastodon instance. The attacker sends an authenticated HTTP request to the admin collections show endpoint referencing a target user's collection identifier. The server returns the target's PII in the response payload. No user interaction from the victim is required, and the attack is delivered over the network.

ruby

# Patch: app/controllers/admin/collections_controller.rb
    end

    def show
-      authorize @collection, :show?
+      authorize [:admin, @collection], :show?
    end

    def batch
# Source: https://github.com/mastodon/mastodon/commit/467c933459c7d0e5513475b9e4888afaedfb1074

The fix prepends the :admin symbol to the authorization tuple, forcing Pundit to resolve Admin::CollectionPolicy#show?, which restricts access to users with administrative privileges.

Detection Methods for CVE-2026-72915

Indicators of Compromise

Requests to /admin/collections/:id originating from non-admin authenticated sessions in Mastodon access logs.
Elevated HTTP 200 responses on admin collection endpoints from user agents lacking admin role claims.
Unusual sequential enumeration of collection IDs by a single account within a short time window.

Detection Strategies

Review Rails production logs for Admin::CollectionsController#show invocations and correlate the acting user's role at request time.
Compare authenticated session role metadata against the controller namespace hit to identify privilege mismatches.
Alert on responses from admin routes that contain email or IP address fields delivered to non-admin session cookies.

Monitoring Recommendations

Ingest Mastodon application and reverse proxy logs into a centralized SIEM for authorization anomaly analytics.
Baseline normal admin route traffic patterns and flag deviations by account role.
Track version strings emitted by Mastodon instances to identify hosts still running vulnerable releases.

How to Mitigate CVE-2026-72915

Immediate Actions Required

Upgrade Mastodon to 4.6.4 or 4.7.0-beta.1 immediately on all affected instances.
Audit access logs for requests to /admin/collections/* from non-admin users since deploying 4.6.0-beta.1.
Rotate exposed email addresses where feasible and notify local users whose PII may have been disclosed.

Patch Information

The fix is available in Mastodon v4.6.4 and v4.7.0-beta.1. Full technical context is documented in GitHub Security Advisory GHSA-hx34-2pfw-2qfj and the corresponding patch commit.

Workarounds

Restrict access to /admin/* routes at the reverse proxy layer to source IP ranges used by administrators until patching is complete.
Temporarily disable local user registrations to reduce the pool of accounts capable of reaching the vulnerable endpoint.
Apply the one-line authorization patch as a hotfix if a full version upgrade cannot be scheduled immediately.

bash

# Nginx example: restrict admin routes to trusted networks
location ^~ /admin/ {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass http://mastodon_backend;
}