The vulnerability involves an improper access control check within Mastodon's administrative collections endpoint. Logged-in local users could use the show action in the collections controller to obtain personal data about another local user, including their current email address and most recently used IP address. The weakness is a classic information disclosure flaw, listed as CWE‑200, and its impact is the unauthorized exposure of sensitive personal data, compromising user privacy and potentially enabling further malicious activity.

Mastodon servers running versions 4.6.0‑beta.1 through 4.6.4 and 4.7.0‑beta.1 are affected. The issue is resolved in 4.6.4 and 4.7.0‑beta.1, so any instance using an earlier version or those versions before the patch deployment is vulnerable.

The CVSS score of 7.5 places the flaw in the high severity range. No EPSS data is available, so the likelihood of exploitation cannot be quantified, but information disclosure vulnerabilities are commonly targeted. The flaw is not listed in CISA's KEV catalog. An attacker would need to be a logged-in local user with any account, and then send a request to the vulnerable show action to retrieve the exposed data; no elevated privileges or external access are required beyond normal user authentication.