CVE Explorer
CVE-2026-33869
Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.5.x branch prior to 4.5.8 and on the 4.4.x branch prior to 4.4.15, an attacker that knows of a quote before it has reached a server can prevent it from being correctly processed on that server. The vulnerability has been patched in Mastodon 4.5.8 and 4.4.15. Mastodon 4.3 and earlier are not affected because they do not support quotes.
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"mastodon","vendor":"mastodon","versions":[{"status":"affected","version":">= 4.5.0, < 4.5.8"},{"status":"affected","version":">= 4.4.0, < 4.4.15"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:eb848483f66fd95bd7feca9cc2ede161b9cba3c5f70795a984976b5b506bf347 · sha256:8450dca7559b6f1b… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:eb848483f66fd95bd7feca9cc2ede161b9cba3c5f70795a984976b5b506bf347 · sha256:8450dca7559b6f1b… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-863","description":"CWE-863: Incorrect Authorization","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:eb848483f66fd95bd7feca9cc2ede161b9cba3c5f70795a984976b5b506bf347 · sha256:8450dca7559b6f1b… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"name":"https://github.com/mastodon/mastodon/security/advisories/GHSA-q4g8-82c5-9h33","tags":["x_refsource_CONFIRM"],"url":"https://github.com/mastodon/mastodon/security/advisories/GHSA-q4g8-82c5-9h33"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:eb848483f66fd95bd7feca9cc2ede161b9cba3c5f70795a984976b5b506bf347 · sha256:8450dca7559b6f1b… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.