CVE-2026-72915

Executive Summary

CVE-2026-72915 is an access control vulnerability in Mastodon, a free, open-source social network server based on ActivityPub. Any logged-in local user can invoke the show action in app/controllers/admin/collections_controller.rb to retrieve personally identifying information (PII) about another local user, including their current email address and last-used IP address. This is caused by the controller using the general collection policy instead of the admin collection policy namespace. The issue affects Mastodon versions from 4.6.0-beta.1 through 4.6.3, and 4.7.0-beta.1 (i.e., all versions up to but excluding 4.6.4, and the first 4.7.0 beta release). The vulnerability is fixed in Mastodon 4.6.4 and 4.7.0-beta.1. Per NVD, no patch evidence has been confirmed by tracked sources, but the NVD description explicitly names 4.6.4 as a fixed release — treat this as the required upgrade target. Exploitation leads to disclosure of sensitive identity data (email address, IP address) for arbitrary local users.

Technical Analysis

The vulnerability resides in the admin collections controller of the Mastodon web application. The application exposes an administrative endpoint — the show action of app/controllers/admin/collections_controller.rb — which is intended to be accessible only to administrators. However, the controller does not invoke the correct authorization check; instead of using the admin collection policy namespace, it falls back to the general collection policy. This policy misassignment means that any authenticated local user (i.e., any user with an account on the same Mastodon instance) can call this endpoint without proper privilege validation.

The data exposed by the show action includes, at minimum, the target user's current email address and last-used IP address. Both of these are classified as personally identifying information (PII) under virtually all privacy frameworks. The email address is a direct identity attribute, and the IP address can be used for geolocation, network attribution, and linking to other accounts or activities.

The flaw is an instance of CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Technically, this is an authorization bypass — specifically, the lack of an explicit privilege check (or reliance on an incorrectly scoped policy object) before serving data from a backend resource. The attack is carried out over the network using HTTP requests, requires no special privileges beyond a standard user account, and needs no user interaction.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a high confidentiality impact with no integrity or availability impact, driven by the sensitive nature of the disclosed data. Note that the PR:N (no privileges required) in the CVSS vector refers to the privileges required from a network-authentication perspective; the NVD description notes that the user must be "logged-in," indicating at minimum a standard account is needed on the target Mastodon instance. The EPSS score is 0.00277 (20th percentile of exploited CVEs), indicating low current exploitation activity in the wild; CISA has not added this to the KEV list, and no public exploit code has been reported.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description. Specific implementation details are not disclosed.

Step 1 — Reconnaissance / Target Identification.
An attacker identifies a Mastodon instance running a vulnerable version (4.6.0-beta.1 through 4.6.3, or 4.7.0-beta.1). This can be done by fingerprinting the Mastodon version via the /api/v1/instance endpoint (which typically exposes the version string), via the web UI footer, or through Shodan queries for Mastodon banners. The attacker then creates a standard user account on the target instance (registration may be open or restricted; if restricted, the attack is limited to instances where the attacker already holds an account, or the attacker targets federated users).

Step 2 — Triggering the Flaw.
The attacker authenticates to the Mastodon instance and crafts an HTTP request to the show action of the admin collections controller, targeting another local user's collection resource. Because the controller incorrectly relies on the general collection policy rather than the admin collection policy namespace, the authorization check is bypassed — no admin token or elevated privilege is required. The request is a standard HTTP GET (or equivalent) to the vulnerable endpoint, with the target user's identifier encoded in the URL path or query string. The exact URL pattern and parameter names are not disclosed in the NVD description and must not be assumed.

Step 3 — Payload / Execution Method.
At the vulnerability-class level, this is an authorization-bypass attack: the attacker sends a legitimate request to an endpoint designed for administrators, but the server does not enforce the privilege requirement. No payload injection, buffer overflow, or code execution is involved. The attacker does not need to craft any malicious data — only a well-formed HTTP request to the vulnerable route. The success of the attack is determined entirely by the server-side policy misconfiguration.

Step 4 — Post-Exploitation Impact.
Upon a successful request, the server returns the target user's current email address and last-used IP address. The attacker can iterate this process across multiple users to harvest a large set of PII from the instance. This information can be used for:

• Targeted phishing campaigns against instance users (using valid email addresses).
• De-anonymization of users who operate under pseudonyms.
• Geolocation / network attribution of users based on IP address.
• Correlation of accounts across instances or platforms (email-based account linkage).
• Selling the harvested PII on underground markets (in bulk, this constitutes a data breach).

Because the attack only requires a standard user account and uses legitimate application functionality, it is unlikely to trigger traditional IDS/IPS signatures, and it generates no anomalous network traffic beyond routine API/controller requests.

Impact Assessment

Business Impact.

• Data Confidentiality Breach: The vulnerability allows any authenticated user to read PII of any other local user. This constitutes a direct violation of the platform's privacy expectations and may trigger mandatory breach notification under GDPR (EU), CCPA (California), or other privacy regulations, depending on the operator's jurisdiction and the number of affected users.
• Reputation and Trust: Mastodon instances are often community-run; a data-exposure incident of this nature erodes user trust and may drive users to other instances.
• Legal/Regulatory Exposure: Operators may face fines, lawsuits, and audit requirements.

Affected Systems / Blast Radius.

• Affected Component: Mastodon app/controllers/admin/collections_controller.rb — the show action.
• Affected Versions: 4.6.0-beta.1 through 4.6.3 (inclusive), plus 4.7.0-beta.1. Fixed in 4.6.4 and 4.7.0-beta.1 (the final 4.7.0 release is implicitly unaffected).
• Exploitable By: Any authenticated local user. No administrator privileges required.
• CVSS Sub-scores: AV:N (network reachable), AC:L (low attack complexity), PR:N (no privileges), UI:N (no user interaction), C:H (high confidentiality impact). The high confidentiality score reflects that the exposed data (email + IP) is sensitive identity information whose disclosure has direct privacy and security consequences.

Threat Landscape.

• EPSS 0.00277 (20th percentile) indicates low observed exploitation; CISA KEV status: NO. No public PoC or exploit code is available at the time of writing. However, the low effort required (single HTTP request with an authenticated session) and the high value (PII) make this an attractive target for opportunistic attackers once the technical details are public. The attack requires no special tools and can be scripted trivially once the endpoint structure is known.

Detection Guidance

The following detection rules are designed to identify HTTP requests that may be targeting the vulnerable admin collections endpoint from non-privileged accounts. Because the precise URL structure beyond app/controllers/admin/collections_controller.rb is not disclosed, these rules use broad patterns and should be tuned by each operator after inspecting their instance logs and the fixed codebase (4.6.4) to determine the exact route.

Sigma Rule

title: Failed Authorization Attempt on Mastodon Admin Collections Endpoint
id: 6f2f29c0-7d3b-4a3e-9b5c-1f8a4d2e9a11
status: experimental
description: >
  Detects HTTP requests from authenticated but non-privileged users
  targeting the Mastodon admin collections 'show' endpoint,
  potentially indicating exploitation of CVE-2026-72915.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-72915
author: Valters IT Security Research
date: 2026/08/12
logsource:
  category: webserver
  product: apache
  # Adjust to match your web server logs (nginx, haproxy, etc.)
detection:
  selection:
    cs-method: 'GET'
    cs-uri-stem|contains: '/admin/collections/'
    cs-uri-query|contains: 'show'
  filter_known_paths:
    cs-uri-stem|contains:
      - '/admin/collections/new'
      - '/admin/collections/create'
  condition: selection and not filter_known_paths
level: medium
falsepositives:
  - Legitimate admins accessing the collections admin UI
  - Unknown URL patterns on non-vulnerable instances
fields:
  - clientip
  - cs-uri-stem
  - cs-uri-query
  - useragent
tags:
  - attack.t1190
  - cve.2026.72915
  - cwe.200
analysis:
  timeline: "Add this rule to your SIEM and monitor for requests to /admin/collections/ from accounts that do not have admin privileges. Correlate with the account's role from the Mastodon application logs."

YARA Rule

rule Mastodon_CVE_2026_72915_Admin_Collections
{
    meta:
        author        = "Valters IT Security Research"
        description   = "Detects references to Mastodon admin collections controller 'show' action and version strings indicative of CVE-2026-72915"
        cve           = "CVE-2026-72915"
        date          = "2026-08-12"
        severity      = "high"
    strings:
        $s_controller = "admin/collections_controller.rb" ascii wide nocase
        $s_show       = "def show" ascii wide nocase
        $s_version_46 = "4.6." ascii wide nocase
        $s_version_47b= "4.7.0" ascii wide nocase
        $s_email      = "email" ascii wide nocase
        $s_ip         = "last-used IP" ascii wide nocase
        $s_general_rule = "general collection policy" ascii wide nocase
    condition:
        any of ($s_version_*) and $s_controller and $s_show
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"Mastodon CVE-2026-72915 Admin Collections Endpoint Access";
    content:"GET"; http_method;
    content:"/admin/collections/"; http_uri;
    content:"show"; http_uri;
    flow:to_server,established;
    metadata:cve CVE-2026-72915;
    metadata:attack_target web_application;
    metadata:deployment Perimeter;
    metadata:signature_severity Major;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2026-72915;
    sid:2026072915;
    rev:1;
)

Elastic Detection

// Elastic EQL — Detects HTTP requests to admin collections endpoints
sequence by host.name with maxspan=1m
  [network where
    network.protocol == "http" and
    url.path == "/admin/collections/" and
    url.query == "show"
  ]
  [file where
    process.name == "rails" and
    file.name == "collections_controller.rb"
  ]

Splunk SPL Query

index=web sourcetype=access_combined
| where match(cs_uri_stem, "^/admin/collections/") 
| search cs_uri_query="show"
| table _time, clientip, user, cs_uri_stem, cs_uri_query, status
| eval cve="CVE-2026-72915"
| outputlookup mastodon_admin_collections_access.csv

Wazuh OSSEC Rule

<group name="mastodon,">
  <rule id="100901" level="12">
    <if_sid>31100</if_sid>
    <match>GET /admin/collections/</match>
    <match>show</match>
    <description>Mastodon: Request to admin collections endpoint detected - potential CVE-2026-72915 exploitation</description>
    <group>mastodon,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <!-- Adjust if_sid to the appropriate Apache/Nginx log rule in your Wazuh setup -->
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED.
Despite the NVD description listing fixed versions (4.6.4 and 4.7.0-beta.1), the patch confidence score reflects that no patch evidence has been confirmed by tracked sources (e.g., no vendor advisory, no commit link). Treat the NVD-listed fixed versions as the authoritative upgrade target, but verify the fix is present before assuming your instance is safe.

Immediate Mitigations (until patch is applied):

1. Upgrade immediately: Upgrade Mastodon to version 4.6.4 (or 4.7.0-beta.1 or later, if you are on the 4.7 beta track). This is the only known fix; no workaround has been published.
2. Restrict Registration: If your instance allows open registration, temporarily disable new account creation to reduce the attack surface (fewer potential malicious users).
3. Tighten Existing Accounts: Review and remove any dormant or suspicious accounts.
4. Network-Level Protections: If you use a reverse proxy (nginx, Apache), implement a temporary rate limit on HTTP requests to the vulnerable path (/admin/collections/) and block requests from non-admin source IPs that match this URI pattern — but note this may be bypassed by fronted/proxied requests.
5. Logging and Monitoring: Enable detailed access logging for all /admin/collections/ requests. Correlate these logs with user privilege levels (available via the Mastodon admin API) to flag non-admin access attempts.

Patch/Upgrade Steps:

1. Back up your Mastodon database and configuration files.
2. Follow the standard Mastodon upgrade procedure in the official documentation (https://docs.joinmastodon.org/admin/upgrade/).
3. Verify the fix: inspect app/controllers/admin/collections_controller.rb and confirm the show action now applies the admin collection policy namespace (or an equivalent privileged policy).
4. Run the database migrations (if any) and restart all Mastodon services (web, streaming, sidekiq).
5. Test with a non-admin account: attempt to call the show endpoint for another user and confirm a 403 or 404 response is returned.

Long-Term Hardening:

1. Enforce least privilege: Review all admin controllers for correct policy namespace usage. Audit all controllers for missing authorization checks.
2. Enable 2FA for all users and enforce MFA for admin accounts.
3. Monitor CISA KEV and vendor advisories (Mastodon GitHub security advisories) on a recurring basis.
4. Implement runtime application self-protection (RASP) or a web application firewall (WAF) with positive security policy for admin endpoints.
5. Conduct periodic security reviews of your instance's authorization code, particularly for any controller exposing user data.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-72915 (CVSS vector, CWE, description)
2. Mastodon Project — https://github.com/mastodon/mastodon (connection failed — verify manually) (source code; check releases for 4.6.4)
3. Mastodon Security Advisories (GitHub) — https://github.com/mastodon/mastodon (connection failed — verify manually)/security/advisories (pending advisory for CVE-2026-72915)
4. Mastodon Upgrade Guide — https://docs.joinmastodon.org/admin/upgrade/
5. CISA KEV Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (note: CVE-2026-72915 is NOT listed)

Threat Actor Campaigns / Exploit-in-the-Wild Evidence:
None identified as of the report date. No public PoC, exploit code, or in-the-wild exploitation evidence exists. EPSS (0.00277) suggests low active exploitation. However, given that Mastodon instances are numerous and often operated by non-professional administrators, a future public PoC would be trivial to weaponize. Monitor the NVD and Mastodon advisories for updates.