CVE-2026-23961

The record

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows server administrators to suspend remote users to prevent interactions. However, some logic errors allow already-known posts from such suspended users to appear in timelines if boosted. Furthermore, under certain circumstances, previously-unknown posts from suspended users can be processed. This issue allows old posts from suspended users to occasionally end up on timelines on all Mastodon versions. Additionally, on Mastodon versions from v4.5.0 to v4.5.4, v4.4.5 to v4.4.11, v4.3.13 to v4.3.17, and v4.2.26 to v4.2.29, remote suspended users can partially bypass the suspension to get new posts in. Mastodon versions v4.5.5, v4.4.12, v4.3.18 are patched.

Affected packages

Related vulnerabilities

• CVE-2026-25540 Mastodon is a free, open-source social network server based on ActivityPub. Also affects mastodon
• CVE-2026-23964 Mastodon is a free, open-source social network server based on ActivityPub. Also affects mastodon
• CVE-2026-23962 Mastodon is a free, open-source social network server based on ActivityPub. Also affects mastodon
• CVE-2026-23963 Mastodon is a free, open-source social network server based on ActivityPub. Also affects mastodon
• CVE-2025-67500 Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration Also affects mastodon
• CVE-2026-96398 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863
• CVE-2026-96384 Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful… CWE-863
• CVE-2026-96370 Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request… CWE-863