What is the CVSS score of CVE-2026-33869?

CVE-2026-33869 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Mastodon are affected by CVE-2026-33869?

Organizations using versions on the 4.5.x branch should be aware of moderate risk from CVE-2026-33869, a incorrect authorization vulnerability rated CVSS 4.8.. A patch is available.

How to fix or mitigate CVE-2026-33869?

Within 30 days: Identify affected systems running versions on the 4.5.x branch and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Mastodon CVE-2026-33869

EUVD-2026-16785 MEDIUM

Incorrect Authorization (CWE-863)

2026-03-27 security-advisories@github.com

Authentication Bypass Mastodon

4.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

4.4.15,4.5.8

EUVD ID Assigned

Mar 27, 2026 - 20:22 euvd

EUVD-2026-16785

Analysis Generated

Mar 27, 2026 - 20:22 vuln.today

CVE Published

Mar 27, 2026 - 20:16 nvd

MEDIUM 4.8

DescriptionGitHub Advisory

Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.5.x branch prior to 4.5.8 and on the 4.4.x branch prior to 4.4.15, an attacker that knows of a quote before it has reached a server can prevent it from being correctly processed on that server. The vulnerability has been patched in Mastodon 4.5.8 and 4.4.15. Mastodon 4.3 and earlier are not affected because they do not support quotes.

AnalysisAI

Mastodon versions 4.5.x before 4.5.8 and 4.4.x before 4.4.15 allow unauthenticated attackers with prior knowledge of a quote to prevent its correct processing on a target server, resulting in limited integrity and availability impact. The vulnerability exploits timing and knowledge of ActivityPub quote structures to disrupt social content distribution. Patches are available in Mastodon 4.5.8 and 4.4.15; versions 4.3 and earlier are unaffected due to lack of quote support.

Technical ContextAI

Mastodon implements the ActivityPub protocol for federated social networking, including support for quote posts (shared in versions 4.4 and later). The vulnerability resides in how Mastodon processes incoming quote objects when they arrive at a server. An attacker with advance knowledge of a quote's structure can craft or time attacks to interfere with server-side validation or processing logic, exploiting insufficient authorization checks or race conditions in quote handling. CWE-863 (Incorrect Authorization) indicates the root cause involves improper permission or validation checks when processing remote ActivityPub quote objects, allowing an unauthenticated attacker to influence quote processing without proper authorization.

RemediationAI

Upgrade Mastodon to version 4.5.8 or later (4.5.x branch) or version 4.4.15 or later (4.4.x branch). No workarounds are documented for earlier versions. Administrators should consult the official Mastodon security advisory at https://github.com/mastodon/mastodon/security/advisories/GHSA-q4g8-82c5-9h33 for deployment guidance and any additional mitigation steps specific to their instance configuration.