CVE-2026-72915

CVE-2026-72915 affects Mastodon versions 4.6.0-beta.1 through 4.6.4 and 4.7.0-beta.1, where a logged-in local user could access PII of another local user via the show action in app/controllers/admin/collections_controller.rb. The vulnerability stems from the controller using the general collectio...