What is the CVSS score of CVE-2026-48028?

CVE-2026-48028 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-48028?

Yes, a patch is available for CVE-2026-48028. Update the affected software to the latest version immediately.

Mastodon CVE-2026-48028

EUVD-2026-39056 MEDIUM

Improper Validation of Integrity Check Value (CWE-354)

2026-06-24 GitHub_M

Information Disclosure Mastodon

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Federation network delivery requires no victim-side auth (AV:N/PR:N/AC:L); impact limited to low integrity spoofing and minor availability disruption; no confidentiality breach.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Jun 24, 2026 - 21:02 EUVD

Analysis Generated

Jun 24, 2026 - 20:21 vuln.today

DescriptionCVE.org

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, Mastodon's normalization of incoming activities signed with Linked-Data Signatures does not sufficiently protect the activities from a certain class of spoofing, allowing threat actors to remove JSON entries from valid signed activities from a third-party actor. This vulnerability is fixed in 4.5.10, 4.4.17, and 4.3.23.

AnalysisAI

Linked-Data Signature normalization in Mastodon allows unauthenticated remote attackers to remove JSON entries from valid signed ActivityPub activities, effectively spoofing or distorting federated content attributed to legitimate third-party actors. All Mastodon instances prior to versions 4.5.10, 4.4.17, and 4.3.23 are affected across all maintained release branches. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects low-complexity network exploitation with no authentication required; no public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV.

Technical ContextAI

Mastodon implements the ActivityPub federation protocol and uses Linked-Data Signatures (LD-Signatures) to authenticate the origin and integrity of activities - such as posts, follows, and boosts - exchanged between federated servers. The root cause is CWE-354 (Improper Validation of Integrity Check Value): the normalization (JSON-LD canonicalization) step applied to incoming signed activities does not sufficiently constrain the set of JSON entries that must remain intact for a signature to be considered valid. This creates a gap where an intermediary can strip JSON-LD entries from a legitimately signed activity, and the modified payload still passes signature verification on the receiving Mastodon instance. The affected product is identified by CPE cpe:2.3:a:mastodon:mastodon:*:*:*:*:*:*:*:*, spanning all versions prior to the fixed releases.

RemediationAI

Vendor-released patches are available: upgrade to Mastodon 4.5.10, 4.4.17, or 4.3.23 depending on the currently deployed release branch, as confirmed by the vendor advisory at https://github.com/mastodon/mastodon/security/advisories/GHSA-53m7-2wrh-q839. No workarounds are described in the available advisory data. Operators unable to patch immediately may consider restricting or suspending federation with unknown or untrusted remote instances by adjusting domain allow/block lists in the Mastodon admin panel - this reduces the attack surface by limiting which servers can deliver activities, but degrades federation reach and is not a substitute for patching. Completely disabling federation eliminates exposure entirely at the cost of full ActivityPub isolation.