CVE-2026-47777

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.6.0

Description A missing condition in the verification process for remote accounts consenting to be featured in a remote Collection allows attackers to bypass checks and fake consent. An attacker can forge the FeatureAuthorization object used to verify this consent, making it appear that an account is permitted to be in a Collection when it is not. Although the FeatureAuthorization must reside on the same domain as the object it represents, the system fails to verify that the object is identical to the one in the Collection item. This issue specifically affects servers running the main branch or nightly builds that have enabled the experimental Collections feature by setting the EXPERIMENTAL FEATURES environment variable to a value including collections.

Recommendations Update to version 4.6.0 or later. As a temporary mitigation, disable the experimental Collections feature by removing collections from the EXPERIMENTAL FEATURES environment variable.