What is the CVSS score of CVE-2026-27468?

CVE-2026-27468 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Mastodon are affected by CVE-2026-27468?

A high-severity vulnerability (CVE-2026-27468) affects Mastodon instances with CVSS 8.2, potentially allowing unauthorized access or registration bypass on affected social network servers.. A patch is available.

How to fix or mitigate CVE-2026-27468?

Within 24 hours: Inventory all Mastodon instances and confirm vulnerability exposure. Within 7 days: Apply available patch to all affected instances and validate successful deployment. Within 30 days: Conduct post-patch security review and document remediation completion.

Mastodon CVE-2026-27468

HIGH

Missing Authorization (CWE-862)

2026-02-24 security-advisories@github.com

Denial Of Service Authentication Bypass Mastodon

8.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Feb 26, 2026 - 15:36 nvd

Patch available

CVE Published

Feb 24, 2026 - 18:29 nvd

HIGH 8.2

DescriptionGitHub Advisory

Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versions 4.4.0 through 4.4.13 and 4.5.0 through 4.5.6, actions performed by a FASP to subscribe to account/content lifecycle events or to backfill content did not check properly whether the FASP was actually approved. This only affects Mastodon servers that have opted in to testing the experimental FASP feature by setting the environment variable EXPERIMENTAL_FEATURES to a value including fasp. An attacker can make subscriptions and request content backfill without approval by an administrator. Done once, this leads to minor information leak of URIs that are publicly available anyway. But done several times this is a serious vector for DOS, putting pressure on the sidekiq worker responsible for the fasp queue. The fix is included in the 4.4.14 and 4.5.7 releases. Admins that are actively testing the experimental "fasp" feature should update their systems. Servers not using the experimental feature flag fasp are not affected.

AnalysisAI

Unauthenticated attackers can bypass FASP administrator approval in Mastodon 4.4.0-4.4.13 and 4.5.0-4.5.6 to subscribe to account events and request content backfill, affecting only servers with the experimental FASP feature enabled. While individual requests cause minor information disclosure of publicly available URIs, repeated exploitation enables denial-of-service attacks. A patch is available to address this authorization bypass.

Technical ContextAI

Classified as CWE-862 (Missing Authorization). Affects Mastodon. Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versions 4.4.0 through 4.4.13 and 4.5.0 through 4.5.6, actions performed by a FASP to subscribe to account/content lifecycle events or to backfill content did not check properly whether the FASP was actually approved. This only affects Mastodon servers that have opted in to testing the experimental FASP feature by setting the environment variable `EXPERIM