CVE-2026-22246: 
NixOS vulnerability analysis and mitigation

CVE-2026-22246 is an authorization bypass vulnerability in Mastodon's severed relationships feature that allows any registered local user to access follower/following loss data from moderation-triggered relationship severance events belonging to other users. Introduced with the Mastodon 4.3 release of the severed relationships notification feature, it affects all Mastodon versions prior to 4.3.17, versions 4.4.0 through 4.4.10, and versions 4.5.0 through 4.5.3. The vulnerability was disclosed on January 7–8, 2026, and fixed versions were released simultaneously. It carries a CVSS v3.1 base score of 6.5 (Medium) per the GitHub Security Advisory, though NVD records a score of 4.3 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is a missing ownership check in the SeveredRelationshipsController (CWE-201: Insertion of Sensitive Information Into Sent Data). The vulnerable code used AccountRelationshipSeveranceEvent.find(params[:id]) to retrieve a severance event by ID without scoping the query to the currently authenticated user, allowing any authenticated local user to supply an arbitrary event ID and retrieve the associated follower/following CSV data. The fix, applied across three patch commits, changed the lookup to AccountRelationshipSeveranceEvent.where(account: current_account).find(params[:id]), which scopes the query to the current user and returns a 404 for unauthorized access attempts (GitHub Advisory, Patch Commit).

Successful exploitation allows any authenticated local Mastodon user to enumerate all severance events on the instance and download CSV lists of lost followers and followed accounts associated with those events. While the leaked data does not include the name of the account that lost the relationships, the follower/following metadata and moderation event patterns exposed represent a significant privacy breach that could enable user profiling and social graph mapping across the platform. There is no integrity or availability impact; the vulnerability is limited to confidentiality loss (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires only a valid local Mastodon account (low privileges) and is exploitable over the network with no user interaction required, making it straightforward to abuse once an attacker has an account on a vulnerable instance. The EPSS score is approximately 0.03%, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Feedly).

1. Obtain a local account: Register or use an existing account on a Mastodon instance running a vulnerable version (prior to 4.3.17, 4.4.11, or 4.5.4).
2. Authenticate: Log in to the Mastodon instance to obtain a valid session token or API credentials.
3. Enumerate severance event IDs: Iterate through integer IDs by sending authenticated GET requests to /severed_relationships/<id>/following.csv or /severed_relationships/<id>/followers.csv, incrementing the ID value (e.g., starting from 1).
4. Retrieve relationship data: For each valid event ID, the server returns a CSV file containing the list of follower or following accounts associated with that severance event, regardless of which user owns the event.
5. Map relationship patterns: Aggregate the collected CSV data across all discovered severance events to build a social graph of moderation-affected relationships on the instance (GitHub Advisory, Patch Commit).

• Network/Logs: Authenticated HTTP GET requests to /severed_relationships/<id>/following.csv or /severed_relationships/<id>/followers.csv with sequentially or randomly varying integer IDs from a single user account, particularly where the requesting account is not the subject of the referenced severance event.
• Logs: Mastodon application logs showing a single user account making repeated requests to the severed relationships download endpoints across many different event IDs in a short time window.
• Logs: Absence of 404 responses for cross-user event ID requests on unpatched instances (patched instances return 404 for unauthorized access).

Mastodon has released patched versions addressing this vulnerability: v4.3.17 for the 4.3.x branch, v4.4.11 for the 4.4.x branch, and v4.5.4 for the 4.5.x branch. Instance administrators should upgrade immediately to the appropriate patched version. As a temporary workaround if immediate patching is not possible, consider restricting access to the severed relationships download endpoints at the reverse proxy or application level, or disabling the feature entirely until the patch can be applied (GitHub Advisory, Feedly).

The vulnerability was discovered and reported by Joshua Rogers of Aisle Research (credited as MegaManSec in the GitHub advisory). The advisory was published by Mastodon maintainer renchap on January 7, 2026, with patches released simultaneously. Coverage appeared on security aggregators and community platforms including Bluesky and infosec blogs shortly after disclosure, with one technical write-up published at infinitsec.net covering the enumeration impact (GitHub Advisory).