CVE-2026-23964: 
NixOS vulnerability analysis and mitigation

CVE-2026-23964 is an Insecure Direct Object Reference (IDOR) vulnerability in Mastodon's web push subscription update endpoint that allows any authenticated user to modify another user's push notification settings by guessing or obtaining the numeric subscription ID. It affects Mastodon versions prior to 4.3.18, 4.4.0–4.4.11, and 4.5.0–4.5.4. The vulnerability was published on January 22, 2026, and patched versions were released on January 20, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) per NVD, and 6.5 (Medium) per the GitHub Security Advisory (GitHub Advisory, Red Hat CVE).

The root cause is an improper authorization check (CWE-863: Incorrect Authorization; CWE-639: Authorization Bypass Through User-Controlled Key) on the web push subscription update endpoint, which uses a sequential numeric subscription ID as the sole resource identifier without verifying that the requesting user owns the subscription. An authenticated attacker can enumerate or guess these numeric IDs and send update requests to the endpoint targeting other users' subscriptions. The endpoint also returns the full subscription object upon update, inadvertently leaking the victim's push notification endpoint URL (though not the keypair). No public proof-of-concept code has been identified (GitHub Advisory, Feedly).

Successful exploitation allows an authenticated attacker to tamper with any other user's web push subscription settings, including changing the notification policy (e.g., filtering notifications from non-followers or non-followed users) and altering the subscribed notification types, effectively disrupting push notifications for targeted users. Additionally, the endpoint response leaks the victim's push notification endpoint URL, which constitutes a low-severity information disclosure of infrastructure details. Availability of push notifications is impacted for any Mastodon user with an active web push subscription, and there is no risk of full account compromise or lateral movement beyond notification disruption (GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation as of the time of reporting (Feedly). The vulnerability requires a valid authenticated session on the target Mastodon instance, limiting the attacker pool to registered users. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was discovered and reported by Joshua Rogers of Aisle Research (credited as MegaManSec in the advisory) (GitHub Advisory).

1. Authenticate: Obtain a valid account on the target Mastodon instance and authenticate to acquire a session token or API access token.
2. Identify the endpoint: Locate the web push subscription update endpoint (typically a PUT/PATCH request to /api/v1/push/subscription or a similar endpoint that accepts a numeric subscription ID).
3. Enumerate subscription IDs: Since subscription IDs are sequential numeric values, iterate through a range of integers (e.g., 1 to N) to identify valid subscription IDs belonging to other users.
4. Send unauthorized update request: Craft an authenticated API request targeting a discovered subscription ID that does not belong to the attacker's own account, modifying the policy field (e.g., setting it to filter all notifications) or altering subscribed notification types.
5. Harvest leaked endpoint URL: Capture the subscription object returned in the API response, which includes the victim's push notification endpoint URL for potential further reconnaissance.
6. Disrupt notifications: Repeat for additional subscription IDs to systematically disrupt push notifications for multiple users on the instance (GitHub Advisory).

• Network: Unusual volume of authenticated API requests to the web push subscription update endpoint with varying numeric subscription IDs from a single user account; sequential or near-sequential subscription ID values in request parameters.
• Logs: Application logs showing repeated PUT/PATCH requests to the push subscription endpoint by a single authenticated user targeting IDs not associated with their own account; HTTP 200 responses to subscription update requests from accounts that do not own the referenced subscription.
• Behavioral: Users reporting unexpected changes to their push notification settings (e.g., notification types toggled off, policy changed to filter all non-followers) without having made those changes themselves.

Mastodon has released patched versions addressing this vulnerability: v4.3.18 (for the 4.3.x branch), v4.4.12 (for the 4.4.x branch), and v4.5.5 (for the 4.5.x branch). Administrators should upgrade to the appropriate patched version immediately using git fetch && git checkout <version> and restarting all Mastodon processes. No configuration-based workaround is available; upgrading is the only remediation. Database backups should be taken before performing any upgrade (GitHub v4.3.18, GitHub v4.4.12, GitHub v4.5.5).

The vulnerability was discovered by Joshua Rogers (MegaManSec) of Aisle Research and responsibly disclosed to the Mastodon project. The advisory was published by Mastodon maintainer renchap on January 20, 2026, alongside coordinated patch releases for three supported branches. Red Hat also tracked the vulnerability in their CVE database. No significant broader media coverage or notable community controversy has been identified beyond the standard security advisory process (GitHub Advisory, Red Hat CVE).