CVE-2026-47777: Mastodon Collections Consent Forgery Vulnerability

Technical summary

The vulnerability stems from incomplete validation logic in Mastodon's Collections implementation. When a remote Mastodon server wants to feature an account in a Collection, it relies on a FeatureAuthorization object to verify that the account holder consented. While Mastodon correctly requires this authorization to originate from the same domain as the target account, it fails to verify that the authorization object actually references the correct account object within the Collection. This missing validation allows an attacker to craft a forged FeatureAuthorization that passes domain checks but authorizes an unrelated account for inclusion. The attacker needs network access to exploit this—no authentication, special privileges, or user interaction are necessary. The integrity violation is high because attackers can misrepresent collection membership and falsely signal consent.

Business impact

For Mastodon instance operators, this vulnerability enables reputation and trust attacks. An attacker can forge authorization to place accounts or content in Collections without genuine consent, potentially defaming individuals, manipulating discovery, or poisoning curated collections. Since this affects only instances with experimental Collections enabled, the immediate exposure is limited to early adopters and test deployments. However, as Collections moves from experimental to stable, the attack surface will expand to production systems. Instances relying on Collections for community moderation, content curation, or trust signaling face the highest risk.

Affected systems

Only Mastodon instances running the main development branch or nightly builds with the experimental Collections feature explicitly enabled via the EXPERIMENTAL_FEATURES environment variable are vulnerable. Stable releases (e.g., 4.5.x and earlier) are not affected. The patch is available in version 4.6.0-beta.1 and later stable releases.

Exploitability

Exploitation is trivial from a technical standpoint. The attack requires only network access to a vulnerable Mastodon instance; no prior authentication, user interaction, or elevated privileges are necessary. An attacker can craft and send a forged FeatureAuthorization object over HTTP/ActivityPub. However, real-world impact depends on the attacker's ability to predict or enumerate valid account IDs and Collection endpoints on the target server. The attack is reliable once an attacker identifies these details.

Remediation

Mastodon operators should immediately upgrade to version 4.6.0-beta.1 or later. For instances running stable releases, the fix will be available in the next stable version following 4.5.x; check the official Mastodon release notes. If you have the experimental Collections feature enabled in a development or nightly build, disable it (unset or modify the EXPERIMENTAL_FEATURES environment variable) until you can apply the patch. Test patches in a staging environment before deploying to production to ensure no disruption to federation.

Patch guidance

Upgrade Mastodon to version 4.6.0-beta.1 or later. The patch corrects the validation logic to ensure that FeatureAuthorization objects are checked not only for correct domain origin but also for matching the specific account object within the Collection. After upgrading, restart your Mastodon services and verify that Collections functionality operates as expected. Monitor federation logs for any unusual authorization attempts during and after the upgrade.

Detection guidance

Monitor incoming ActivityPub requests for FeatureAuthorization objects that originate from domains matching the target account but reference mismatched or unexpected account identifiers within Collections. Log and alert on instances where the domain of the authorization issuer differs from the account domain, or where Collection features reference accounts not explicitly authorized. If you maintain Mastodon logs, search for Collection-related operations or FeatureAuthorization processing errors that may indicate exploit attempts. Intrusion detection signatures should focus on HTTP POST requests to Collections endpoints with inconsistent authorization metadata.

Why prioritize this

This vulnerability rates HIGH (CVSS 7.5) due to network-exploitable integrity violations requiring no authentication or user interaction. While the impact is currently limited to experimental feature users, the ease of exploitation and the breach of trust in consent mechanisms warrant rapid patching. Early adopters and organizations testing Collections for production deployment should treat this as urgent. Standard Mastodon users on stable releases have no immediate exposure but should plan to upgrade when the fix lands in a stable release.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects an unauthenticated network attack (AV:N, AC:L, PR:N) with no confidentiality impact but high integrity impact (I:H). The vulnerability does not cause availability issues or alter system functionality beyond the intended Collections feature. The score is appropriate because it captures the ease of exploitation and the meaningful trust violation, offset by the limited scope (experimental feature only) and absence of information disclosure or denial-of-service elements.

Frequently asked questions