CVE-2026-48028: Mastodon

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, Mastodon's normalization of incoming activities signed with Linked-Data Signatures does not sufficiently protect the activities from a certain class of spoofing, allowing threat actors to remove JSON entries from valid signed activities from a third-party actor. This vulnerability is fixed in 4.5.10, 4.4.17, and 4.3.23.

Affected products

• Mastodon Mastodon: from 4.5.0-beta.1, before 4.5.10 (fixed in 4.5.10); from 4.4.0-beta.1, before 4.4.17 (fixed in 4.4.17); before 4.3.23 (fixed in 4.3.23)

Published 2026-06-24. Last modified 2026-06-25.