Which versions of Mastodon are affected by CVE-2026-41259?

Mastodon self-hosted instances running versions before v4.5.9, v4.4.16, and v4.3.22 can be bypassed by unauthenticated attackers who craft email addresses to circumvent registration domain…. A patch is available.

How to fix or mitigate CVE-2026-41259?

Within 24 hours, identify all deployed Mastodon instances and confirm whether registration is currently restricted by email domain. Within 7 days, upgrade instances running v4.5.x to v4.5.9, v4.4.x to v4.4.16, or v4.3.x to v4.3.22, then validate that email domain restrictions are properly enforced post-upgrade. Within 30 days, audit recent account registrations created before the upgrade, remove any unauthorized accounts, and document any email address patterns used in bypass attempts to refine domain policies.

Mastodon CVE-2026-41259

Q: What is the CVSS score of CVE-2026-41259?

CVE-2026-41259 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25282 HIGH

Improper Enforcement of Behavioral Workflow (CWE-841)

2026-04-23 security-advisories@github.com

Information Disclosure Mastodon

8.2

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

Remote and unauthenticated (AV:N/PR:N), but success depends on the target MTA's parsing so AC:H maps the 4.0 AT:P; impact is a control-integrity bypass only, hence I:H with C:N/A:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:29 vuln.today

Patch released

Apr 28, 2026 - 18:50 nvd

Patch available

Apr 23, 2026 - 21:01 EUVD

EUVD ID Assigned

Apr 23, 2026 - 19:27 euvd

EUVD-2026-25282

CVE Published

Apr 23, 2026 - 19:17 nvd

HIGH 8.2

DescriptionGitHub Advisory

Mastodon is a free, open-source social network server based on ActivityPub. Prior to v4.5.9, v4.4.16, and v4.3.22, Mastodon allows restricting new user sign-up based on e-mail domain names, and performs basic validation on e-mail addresses, but fails to restrict characters that are interpreted differently by some mailing servers. This vulnerability is fixed in v4.5.9, v4.4.16, and v4.3.22.

AnalysisAI

Sign-up restriction bypass in Mastodon (self-hosted ActivityPub social server) before v4.5.9, v4.4.16, and v4.3.22 allows remote attackers to register accounts on instances that restrict registration by e-mail domain. Because Mastodon validates addresses but does not restrict characters that downstream mail servers interpret differently, a crafted address can pass the allow/deny-list check while ultimately delivering mail to a domain the operator intended to block. No public exploit identified at time of analysis, and EPSS is very low (0.04%), but SSVC rates the flaw automatable with partial technical impact.

Technical ContextAI

Mastodon is a Ruby on Rails ActivityPub server whose instance operators commonly gate self-service registration using an e-mail domain allow-list or deny-list (the 'Allowed/Disallowed e-mail domains' feature). The root cause is CWE-841 (Improper Enforcement of Behavioral Workflow / expected conditions): Mastodon performs its own basic RFC-style validation and domain-matching, but different SMTP/MTA implementations parse address quoting, comments, or additional special characters differently than Mastodon's parser does. This parser-differential means the domain Mastodon sees during its policy check is not necessarily the domain the receiving mail server routes to, so the security decision (should this domain be allowed to sign up?) is made on a different value than the one that actually governs delivery. The single affected component per NVD/EUVD CPE is cpe:2.3:a:joinmastodon:mastodon across all pre-fix versions.

RemediationAI

Vendor-released patch: upgrade to Mastodon 4.5.9, 4.4.16, or 4.3.22 (whichever matches your release line) as published in GitHub Security Advisory GHSA-5r37-qpwq-2jhh (https://github.com/mastodon/mastodon/security/advisories/GHSA-5r37-qpwq-2jhh), which adds restriction of the mis-interpreted characters during address validation. If you cannot patch immediately, compensating controls include switching the registration mode to approval-required (manual moderator review of each sign-up), which neutralizes the bypass at the cost of operator workload, or moving to invite-only registration, which stops open sign-up entirely but changes your community growth model. Operators who depend on domain deny-lists to block disposable-mail providers should treat that control as unreliable until patched and increase post-registration abuse monitoring; tightening the upstream MTA/relay to reject the same malformed-but-accepted addresses can also reduce, though not fully close, the parser gap.