What is the CVSS score of CVE-2026-72915?

CVE-2026-72915 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Mastodon are affected by CVE-2026-72915?

Mastodon social media instances running versions 4.6.0 through 4.6.3 expose user email addresses and IP addresses to any authenticated account holder on the platform.. A patch is available.

How to fix or mitigate CVE-2026-72915?

Within 24 hours, identify all Mastodon instances running versions 4.6.0-beta.1 through 4.6.3. Within 7 days, upgrade all affected instances to Mastodon 4.6.4 stable release. Within 30 days, audit access logs to the admin collections controller to detect if the vulnerability was exploited during the exposure window, and notify affected users of any confirmed unauthorized access to their email addresses and IP information.

Mastodon CVE-2026-72915

EUVD-2026-55838 HIGH

Information Exposure (CWE-200)

2026-08-10 security-advisories@github.com

Information Disclosure

7.5

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Requires a valid authenticated local session (PR:L) per description; NVD's PR:N overstates risk. No integrity or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Aug 10, 2026 - 22:37 vuln.today

Analysis Generated

Aug 10, 2026 - 22:37 vuln.today

Patch available

Aug 10, 2026 - 22:20 EUVD

CVE Published

Aug 10, 2026 - 22:17 cve.org

HIGH 7.5

DescriptionCVE.org

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access personally identifying information about another local user in a collection because the controller used the general collection policy instead of the admin collection policy namespace. The exposed data included the other user's current email address and last-used IP address. This issue is fixed in versions 4.6.4 and 4.7.0-beta.1.

AnalysisAI

Authenticated regular users on Mastodon instances running 4.6.0-beta.1 through 4.6.3 can access personally identifying information - specifically the email address and last-used IP address - belonging to any other local user by invoking the admin collections controller show action, which incorrectly resolved to the general collection policy instead of the admin-scoped policy. The root cause is a single missing namespace argument in a Pundit authorize call (authorize @collection vs. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain or hold valid local Mastodon account

Delivery

Authenticate to target instance

Exploit

Send GET request to /admin/collections/:id with victim's collection ID

Execution

Server resolves wrong Pundit policy (CollectionPolicy instead of Admin::CollectionPolicy)

Persist

Authorization passes without admin check

Impact

Receive victim's email address and last-used IP address

Access

Obtain or hold valid local Mastodon account

Delivery

Authenticate to target instance

Exploit

Send GET request to /admin/collections/:id with victim's collection ID

Execution

Server resolves wrong Pundit policy (CollectionPolicy instead of Admin::CollectionPolicy)

Persist

Authorization passes without admin check

Impact

Receive victim's email address and last-used IP address

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid authenticated local session on the target Mastodon instance - the attacker must be a registered local user, not a remote federated account from another ActivityPub instance. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD-assigned CVSS base score of 7.5 with vector AV:N/AC:L/PR:N/UI:N directly conflicts with the CVE description, which specifies 'any logged-in local user' as the threat actor - authentication is required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated regular user on a multi-user Mastodon instance sends a GET request to /admin/collections/:id, substituting the collection ID of a target user. The server's Pundit authorize check resolves to the general CollectionPolicy rather than Admin::CollectionPolicy, passes without error, and returns the target user's current email address and last-used IP address in the response. …
Remediation	Upgrade to Mastodon 4.6.4 (stable) immediately; the release is confirmed at https://github.com/mastodon/mastodon/releases/tag/v4.6.4 and docker-compose users should update to ghcr.io/mastodon/mastodon:v4.6.4. … Detailed patch versions, workarounds, and compensating controls in full report.