Mastodon CVE-2026-41259

Exploitation requires that the target Mastodon instance has e-mail-domain-based sign-up restriction enabled (allowed or disallowed domain lists) - an instance with open unrestricted registration or invite-only registration gains nothing from the bypass. The attacker must craft an e-mail address whose special/quoting characters are parsed differently by Mastodon's validator than by the instance's actual mail server, so success is gated by the specific MTA in use (reflected as AT:P in the CVSS 4.0 vector). No authentication and no user interaction are needed (PR:N/UI:N, AV:N), but the impact is limited to defeating the domain restriction control (integrity only, VI:H; no data disclosure or service disruption).

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N) scores 8.2 High, driven entirely by an integrity impact (VI:H) - the ability to defeat a security control - with no confidentiality or availability impact. AT:P (attack requirements present) reflects that success depends on the victim instance's specific MTA parsing behavior, which the attacker does not fully control, so this is not a clean push-button exploit. Contrast the signals: EPSS is 0.04% (13th percentile) and SSVC exploitation status is 'none', indicating no observed real-world attacks, yet SSVC flags it as Automatable=yes with partial technical impact, consistent with a control-bypass that could be scripted once a working character/domain combination is found. This is a moderate, control-integrity issue rather than an urgent RCE: the practical risk is concentrated on instances that actually rely on e-mail-domain restriction as a spam/abuse gate, and is negligible for open-registration or invite-only instances. The high CVSS number somewhat overstates day-to-day urgency given zero exploitation evidence and MTA-dependent preconditions.

An operator runs an open-registration Mastodon instance that blocks sign-ups from a set of disposable e-mail domains to curb spam accounts. An attacker crafts an e-mail address containing quoting or special characters so that Mastodon's validator reads an allowed domain while the instance's mail server actually delivers the confirmation link to a blocked/disposable domain, letting the attacker confirm the account and bypass the restriction. No public proof-of-concept is identified; success depends on the target instance's specific mail-server parsing behavior.