app/models/user.rb in Mastodon before 3.5.0 allows a bypass of e-mail restrictions.
{ "cpes": [ "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*" ], "severity": "Medium" }