https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 00:26:05 +0000 https://db.gcve.eu/vuln/bit-mastodon-2026-72915 <p><strong>Affected:</strong> Bitnami: mastodon</p> <p>Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0 until 4.6.4 and 4.7.0, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access personally identifying information about another local user in a collection because the controller used the general collection policy instead of the admin collection policy namespace. The exposed data included the other user&#39;s current email address and last-used IP address. This issue is fixed in versions 4.6.4 and 4.7.0.</p> <p><strong>Affected:</strong> Bitnami: mastodon</p> <p>Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0 until 4.6.4 and 4.7.0, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access personally identifying information about another local user in a collection because the controller used the general collection policy instead of the admin collection policy namespace. The exposed data included the other user&#39;s current email address and last-used IP address. This issue is fixed in versions 4.6.4 and 4.7.0.</p> https://db.gcve.eu/vuln/bit-mastodon-2026-72915 https://db.gcve.eu/vuln/fkie_cve-2026-72915 <p>Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access personally identifying information about another local user in a collection because the controller used the general collection policy instead of the admin collection policy namespace. The exposed data included the other user&#39;s current email address and last-used IP address. This issue is fixed in versions 4.6.4 and 4.7.0-beta.1.</p> <p>Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access personally identifying information about another local user in a collection because the controller used the general collection policy instead of the admin collection policy namespace. The exposed data included the other user&#39;s current email address and last-used IP address. This issue is fixed in versions 4.6.4 and 4.7.0-beta.1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-72915