# mastodon.

Every CVE that names mastodon among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Mastodon: Unwanted deactivation of SSL/TLS certificate verification](https://agentprime.io/advisories/CVE-2026-59825.md)
  `CVE-2026-59825` · CVE record: mastodon mastodon · CVSS 7.4 High · Not analysed yet · Published 18 Aug 2026 · Tags: Weak cryptography or TLS
- [Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses](https://agentprime.io/advisories/CVE-2026-72916.md)
  `CVE-2026-72916` · CVE record: mastodon mastodon · CVSS 6.3 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Server-side request forgery (SSRF), CWE-1286
- [Mastodon: Personally-identifying information disclosure due to incorrect access control validation](https://agentprime.io/advisories/CVE-2026-72915.md)
  `CVE-2026-72915` · CVE record: mastodon mastodon · CVSS 7.5 High · Not analysed yet · Published 10 Aug 2026 · Tags: Information disclosure
- [Mastodon: Exhausting data by an unauthenticated request to the admin retention API](https://agentprime.io/advisories/CVE-2026-72914.md)
  `CVE-2026-72914` · CVE record: mastodon mastodon · CVSS 7.5 High · Not analysed yet · Published 10 Aug 2026 · Tags: Denial of service, CWE-405
- [Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH_TRANSFORMER](https://agentprime.io/advisories/CVE-2026-50129.md)
  `CVE-2026-50129` · CVE record: mastodon mastodon · CVSS 7.5 High · Not analysed yet · Published 24 Jun 2026 · Tags: CWE-248
- [Mastodon: Spoofing of attribution domains](https://agentprime.io/advisories/CVE-2026-50128.md)
  `CVE-2026-50128` · CVE record: mastodon mastodon · CVSS 5.3 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: CWE-354
- [Mastodon: Removal of integrity-protected JSON entries from signed activities](https://agentprime.io/advisories/CVE-2026-48028.md)
  `CVE-2026-48028` · CVE record: mastodon mastodon · CVSS 6.5 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: CWE-354
- [Mastodon: SSRF protection bypass on older Ruby versions](https://agentprime.io/advisories/CVE-2026-47389.md)
  `CVE-2026-47389` · CVE record: mastodon mastodon · CVSS 8.6 High · Not analysed yet · Published 24 Jun 2026 · Tags: Information disclosure, Server-side request forgery (SSRF), CWE-184
- [Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring](https://agentprime.io/advisories/CVE-2026-46349.md)
  `CVE-2026-46349` · CVE record: mastodon mastodon · CVSS 5.3 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Weak cryptography or TLS
- [Mastodon: SSRF Bypass via IPv6 Unspecified Address (::)](https://agentprime.io/advisories/CVE-2026-46348.md)
  `CVE-2026-46348` · CVE record: mastodon mastodon · CVSS 8.7 High · Not analysed yet · Published 24 Jun 2026 · Tags: Server-side request forgery (SSRF)
- [Mastodon has a consent-check bypass in its remote Collections](https://agentprime.io/advisories/CVE-2026-47777.md)
  `CVE-2026-47777` · CVE record: mastodon mastodon · CVSS 7.5 High · Not analysed yet · Published 15 Jun 2026 · Tags: Broken access control, CWE-345
- [Mastodon: Insufficient verification of email addresses](https://agentprime.io/advisories/CVE-2026-41259.md)
  `CVE-2026-41259` · CVE record: mastodon mastodon · CVSS 8.2 High · Not analysed yet · Published 23 Apr 2026 · Tags: CWE-841
- [Mastodon has a denial of service for quote authorization](https://agentprime.io/advisories/CVE-2026-33869.md)
  `CVE-2026-33869` · CVE record: mastodon mastodon · CVSS 4.8 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: Broken access control
- [Mastodon has a GET-Based Open Redirect via '/web/%2F\<domain>'](https://agentprime.io/advisories/CVE-2026-33868.md)
  `CVE-2026-33868` · CVE record: mastodon mastodon · CVSS 4.3 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: Open redirect
- [Mastodon has SSRF via unvalidated FASP Provider base_url](https://agentprime.io/advisories/CVE-2026-27477.md)
  `CVE-2026-27477` · CVE record: mastodon mastodon · CVSS 4.6 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Mastodon may allow unconfirmed FASP to make subscriptions](https://agentprime.io/advisories/CVE-2026-27468.md)
  `CVE-2026-27468` · CVE record: mastodon mastodon · CVSS 4.8 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Broken access control
- [Mastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via \`Rails.cache\`)](https://agentprime.io/advisories/CVE-2026-25540.md)
  `CVE-2026-25540` · CVE record: mastodon mastodon · CVSS 6.5 Medium · Not analysed yet · Published 4 Feb 2026 · Tags: CWE-524
- [Mastodon has insufficient access control to push notification settings](https://agentprime.io/advisories/CVE-2026-23964.md)
  `CVE-2026-23964` · CVE record: mastodon mastodon · CVSS 6.5 Medium · Not analysed yet · Published 22 Jan 2026 · Tags: Broken access control
- [Mastodon missing length limits on list names, filter names, and filter keywords](https://agentprime.io/advisories/CVE-2026-23963.md)
  `CVE-2026-23963` · CVE record: mastodon mastodon · CVSS 4.3 Medium · Not analysed yet · Published 22 Jan 2026 · Tags: Denial of service
- [Mastodon vulnerable to Denial of Service from a single post (client/server)](https://agentprime.io/advisories/CVE-2026-23962.md)
  `CVE-2026-23962` · CVE record: mastodon mastodon · CVSS 7.5 High · Not analysed yet · Published 22 Jan 2026 · Tags: Denial of service
- [Mastodon may allow a remote suspension bypass](https://agentprime.io/advisories/CVE-2026-23961.md)
  `CVE-2026-23961` · CVE record: mastodon mastodon · CVSS 5.3 Medium · Not analysed yet · Published 22 Jan 2026 · Tags: Broken access control
- [Local Mastodon users can enumerate and access severed relationships of every other local user](https://agentprime.io/advisories/CVE-2026-22246.md)
  `CVE-2026-22246` · CVE record: mastodon mastodon · CVSS 6.5 Medium · Not analysed yet · Published 8 Jan 2026 · Tags: Information disclosure
- [Mastodon has SSRF Protection bypass](https://agentprime.io/advisories/CVE-2026-22245.md)
  `CVE-2026-22245` · CVE record: mastodon mastodon · CVSS 7.1 High · Not analysed yet · Published 8 Jan 2026 · Tags: Server-side request forgery (SSRF)
- [Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration](https://agentprime.io/advisories/CVE-2025-67500.md)
  `CVE-2025-67500` · CVE record: mastodon mastodon · CVSS 3.7 Low · Not analysed yet · Published 9 Dec 2025 · Tags: CWE-204
- [Mastodon quotes control can be bypassed](https://agentprime.io/advisories/CVE-2025-62605.md)
  `CVE-2025-62605` · CVE record: mastodon mastodon · CVSS 4.3 Medium · Not analysed yet · Published 21 Oct 2025 · Tags: CWE-754
- [Mastadon streaming server allows OAuth clients without the \`read\` scope to subscribe to public channels](https://agentprime.io/advisories/CVE-2025-62176.md)
  `CVE-2025-62176` · CVE record: mastodon mastodon · CVSS 4.3 Medium · Not analysed yet · Published 13 Oct 2025 · Tags: CWE-280
- [Mastodon streaming API fails to disconnect disabled and suspended users](https://agentprime.io/advisories/CVE-2025-62175.md)
  `CVE-2025-62175` · CVE record: mastodon mastodon · CVSS 4.3 Medium · Not analysed yet · Published 13 Oct 2025 · Tags: CWE-273, CWE-274
- [Mastodon allows continued access after password reset via CLI](https://agentprime.io/advisories/CVE-2025-62174.md)
  `CVE-2025-62174` · CVE record: mastodon mastodon · CVSS 3.5 Low · Not analysed yet · Published 13 Oct 2025 · Tags: Authentication bypass
- [Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails](https://agentprime.io/advisories/CVE-2025-54879.md)
  `CVE-2025-54879` · CVE record: mastodon mastodon · CVSS 5.3 Medium · Not analysed yet · Published 5 Aug 2025 · Tags: Denial of service
- [Mastodon's domain blocks & rationales ignore user approval when visibility set as "users"](https://agentprime.io/advisories/CVE-2025-27399.md)
  `CVE-2025-27399` · CVE record: mastodon mastodon · CVSS 5.3 Medium · Not analysed yet · Published 27 Feb 2025 · Tags: Information disclosure, Broken access control
- [Mastodon's rate-limits are missing on \`/auth/setup\`](https://agentprime.io/advisories/CVE-2025-27157.md)
  `CVE-2025-27157` · CVE record: mastodon mastodon · CVSS 5.3 Medium · Not analysed yet · Published 27 Feb 2025 · Tags: Denial of service
- [Mastodon has improper authorship check on audience extension for existing posts](https://agentprime.io/advisories/CVE-2024-37903.md)
  `CVE-2024-37903` · CVE record: mastodon mastodon · CVSS 8.2 High · Not analysed yet · Published 5 Jul 2024 · Tags: Broken access control
- [Lack of media type verification of Activity Streams objects allows impersonation of remote accounts](https://agentprime.io/advisories/CVE-2024-25623.md)
  `CVE-2024-25623` · CVE record: mastodon mastodon · CVSS 8.5 High · Not analysed yet · Published 19 Feb 2024 · Tags: Unrestricted file upload
- [Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodon](https://agentprime.io/advisories/CVE-2024-25619.md)
  `CVE-2024-25619` · CVE record: mastodon mastodon · CVSS 3.1 Low · Not analysed yet · Published 14 Feb 2024 · Tags: Authentication bypass, CWE-672
- [External OpenID Connect Account Takeover by E-Mail Change in mastodon](https://agentprime.io/advisories/CVE-2024-25618.md)
  `CVE-2024-25618` · CVE record: mastodon mastodon · CVSS 4.2 Medium · Not analysed yet · Published 14 Feb 2024 · Tags: Authentication bypass
- [Mastodon Remote user impersonation and takeover](https://agentprime.io/advisories/CVE-2024-23832.md)
  `CVE-2024-23832` · CVE record: mastodon mastodon · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Feb 2024 · Tags: Authentication bypass
- [Mastodon vulnerable to Stored XSS through the translation feature](https://agentprime.io/advisories/CVE-2023-42452.md)
  `CVE-2023-42452` · CVE record: mastodon mastodon · CVSS 6.1 Medium · Not analysed yet · Published 19 Sept 2023 · Tags: Cross-site scripting (XSS)
- [Mastodon Invalid Domain Name Normalization vulnerability](https://agentprime.io/advisories/CVE-2023-42451.md)
  `CVE-2023-42451` · CVE record: mastodon mastodon · CVSS 7.4 High · Not analysed yet · Published 19 Sept 2023 · Tags: CWE-706
- [Mastodon Server-Side Request Forgery vulnerability](https://agentprime.io/advisories/CVE-2023-42450.md)
  `CVE-2023-42450` · CVE record: mastodon mastodon · CVSS 5.4 Medium · Not analysed yet · Published 19 Sept 2023 · Tags: Other injection, Server-side request forgery (SSRF)
- [Mastodon's verified profile links can be formatted in a misleading way](https://agentprime.io/advisories/CVE-2023-36462.md)
  `CVE-2023-36462` · CVE record: mastodon mastodon · CVSS 5.4 Medium · Not analysed yet · Published 6 Jul 2023 · Tags: CWE-20
- [Mastodon vulnerable to Denial of Service through slow HTTP responses](https://agentprime.io/advisories/CVE-2023-36461.md)
  `CVE-2023-36461` · CVE record: mastodon mastodon · CVSS 7.5 High · Not analysed yet · Published 6 Jul 2023 · Tags: Denial of service
- [Mastodon vulnerable to arbitrary file creation through media attachments](https://agentprime.io/advisories/CVE-2023-36460.md)
  `CVE-2023-36460` · CVE record: mastodon mastodon · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.40 · Not analysed yet · Published 6 Jul 2023 · Tags: Path traversal
- [Mastodon vulnerable to Cross-site Scripting through oEmbed preview cards](https://agentprime.io/advisories/CVE-2023-36459.md)
  `CVE-2023-36459` · CVE record: mastodon mastodon · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2023 · Tags: Cross-site scripting (XSS)
- [Mastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP database](https://agentprime.io/advisories/CVE-2023-28853.md)
  `CVE-2023-28853` · CVE record: mastodon mastodon · CVSS 7.7 High · Not analysed yet · Published 4 Apr 2023 · Tags: Other injection

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=mastodon>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/mastodon/>. Everything for agents: <https://agentprime.io/llms.txt>.