# CVE-2026-47777: Mastodon authorization bypass in experimental Collections feature

Source: https://junglewise.ai/threats/cve-2026-47777-mastodon-authorization-bypass-in-experimental-collections-feature  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-47777 · Severity: high · CVSS 7.5 · Published 2026-06-15

Mastodon is an open-source decentralized social networking platform. A security flaw in an experimental feature allowed attackers to falsely claim that a user had consented to be featured in a specific group or collection. This could be used to misrepresent a user's affiliations or include their profile in collections against their will, potentially damaging their reputation or privacy.

Technologies: [Mastodon](https://junglewise.ai/threats/technologies/mastodon). Vendors: [Mastodon](https://junglewise.ai/threats/vendors/mastodon).

## Quick answers

**Is CVE-2026-47777 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47777 being exploited in the wild.

**How severe is CVE-2026-47777?** High severity, with a CVSS score of 7.5, published 15 June 2026.

**Which products and versions are affected?** Mastodon nightly builds between 2026-03-10 and 2026-05-21; main branch prior to commit 22203f8.

**Is there a fix for CVE-2026-47777?** A patch was published on 2026-05-21: Fixed in nightly builds and main branch commit 22203f8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47777 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-47777?** Check whether you run Mastodon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authorization bypass exists in Mastodon's experimental 'Collections' feature due to insufficient verification of the FeatureAuthorization object. While the system checks that the authorization originates from the correct domain, it fails to verify that the object referenced in the authorization matches the item being added to the Collection. A remote, unauthenticated attacker can exploit this missing condition to forge consent, making it appear as if a remote account has agreed to be featured. This vulnerability only affects servers running nightly or main branch builds with the EXPERIMENTAL_FEATURES environment variable set to include 'collections'. The issue is addressed in version 4.6.0-beta.1 and nightly builds starting from 2026-05-21.

## Affected products

- Mastodon Mastodon nightly builds between 2026-03-10 and 2026-05-21; main branch prior to commit 22203f8

## Timeline

- 2026-05-20: advisory: GitHub Security Advisory published
- 2026-05-21: patched: Fixed in nightly builds and main branch commit 22203f8
- 2026-06-15: disclosed: CVE-2026-47777 published to NVD

## References

- [https://github.com/mastodon/mastodon/commit/22203f8aeb03e8f14dc62e253e83db39825a5bcf](https://github.com/mastodon/mastodon/commit/22203f8aeb03e8f14dc62e253e83db39825a5bcf)
- [https://github.com/mastodon/mastodon/security/advisories/GHSA-vg36-gxjg-2v46](https://github.com/mastodon/mastodon/security/advisories/GHSA-vg36-gxjg-2v46)

## Related threats

- [Mastodon LDAP authentication global TLS verification bypass](https://junglewise.ai/threats/cve-2026-59825-mastodon-ldap-authentication-global-tls-verification-bypass)
- [Mastodon denial of service via uncaught exception in math sanitizer](https://junglewise.ai/threats/cve-2026-50129-mastodon-denial-of-service-via-uncaught-exception-in-math)
- [Mastodon signature verification bypass in attributionDomains spoofing](https://junglewise.ai/threats/cve-2026-50128-mastodon-signature-verification-bypass-in-attributiondomains)
- [Mastodon spoofing via JSON entry removal in signed activities](https://junglewise.ai/threats/cve-2026-48028-mastodon-spoofing-via-json-entry-removal-in-signed-activities)
- [Mastodon SSRF protection bypass in PrivateAddressCheck](https://junglewise.ai/threats/cve-2026-47389-mastodon-ssrf-protection-bypass-in-privateaddresscheck)