Released on October 17, 2026.
- Fixed a security vulnerability where any authenticated user with the
write:statusesscope could delete another local account's post or a cached remote post by its UUID and receive the deleted post's contents. Status deletion now requires the post to belong to the account associated with the access token. [GHSA-v2qh-w789-xxj6]