app/models/user.rb in Mastodon before 3.5.0 allows a bypass of e-mail restrictions.
{ "severity": "Medium", "cpes": [ "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*" ] }