{"id":"CVE-2026-72915","title":"Mastodon is a free, open-source social network server based on ActivityPub","summary":"Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access p…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-200"],"published":"2026-08-10","updated":"2026-09-09","sourceUpdated":"2026-09-09T20:55:04.493","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72915","references":[{"url":"https://github.com/mastodon/mastodon/commit/467c933459c7d0e5513475b9e4888afaedfb1074","label":"security-advisories@github.com"},{"url":"https://github.com/mastodon/mastodon/commit/930aa9fee26bf9eaefe27826fa1061288d83373b","label":"security-advisories@github.com"},{"url":"https://github.com/mastodon/mastodon/releases/tag/v4.6.4","label":"security-advisories@github.com"},{"url":"https://github.com/mastodon/mastodon/releases/tag/v4.7.0-beta.1","label":"security-advisories@github.com"},{"url":"https://github.com/mastodon/mastodon/security/advisories/GHSA-hx34-2pfw-2qfj","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.00483,"epssPercentile":0.39059,"ingestedAt":"2026-09-09T21:22:45.526Z","slug":"CVE-2026-72915","body":"## Overview\n\nMastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access personally identifying information about another local user in a collection because the controller used the general collection policy instead of the admin collection policy namespace. The exposed data included the other user's current email address and last-used IP address. This issue is fixed in versions 4.6.4 and 4.7.0-beta.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}