High severity7.5NVD Advisory· Published Apr 23, 2026· Updated Apr 28, 2026
CVE-2026-41259
CVE-2026-41259
Description
Mastodon is a free, open-source social network server based on ActivityPub. Prior to v4.5.9, v4.4.16, and v4.3.22, Mastodon allows restricting new user sign-up based on e-mail domain names, and performs basic validation on e-mail addresses, but fails to restrict characters that are interpreted differently by some mailing servers. This vulnerability is fixed in v4.5.9, v4.4.16, and v4.3.22.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- github.com/mastodon/mastodon/security/advisories/GHSA-5r37-qpwq-2jhhnvdVendor Advisory
News mentions
5- Windows Zero-Days Expose BitLocker Bypasses And CTFMON Privilege EscalationThe Hacker News · May 14, 2026
- Another Universal Linux Local Privilege Escalation (LPE) Vulnerability: Dirty Frag, (Fri, May 8th)SANS Internet Storm Center · May 8, 2026
- Shutdowns, power outages, and conflict: a review of Q1 2026 Internet disruptionsCloudflare Blog · Apr 28, 2026
- It pays to be a forever studentCisco Talos Intelligence · Apr 23, 2026
- Risky Business #834 -- Vercel gets owned, Mozilla dumps hundreds of Mythos bugsRisky Business · Apr 22, 2026