Advisories · Technology
mastodon.
Every CVE that names mastodon among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.4 High
Mastodon: Unwanted deactivation of SSL/TLS certificate verification
- mastodon
- Weak cryptography or TLS
- CVSS 6.3 Medium
Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses
- mastodon
- Server-side request forgery (SSRF)
- CWE-1286
- CVSS 7.5 High
Mastodon: Personally-identifying information disclosure due to incorrect access control validation
- mastodon
- Information disclosure
- CVSS 7.5 High
Mastodon: Exhausting data by an unauthenticated request to the admin retention API
- mastodon
- Denial of service
- CWE-405
- CVSS 7.5 High
Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH_TRANSFORMER
- mastodon
- CWE-248
- CVSS 5.3 Medium
Mastodon: Spoofing of attribution domains
- mastodon
- CWE-354
- CVSS 6.5 Medium
Mastodon: Removal of integrity-protected JSON entries from signed activities
- mastodon
- CWE-354
- CVSS 8.6 High
Mastodon: SSRF protection bypass on older Ruby versions
- mastodon
- Information disclosure
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring
- mastodon
- Weak cryptography or TLS
- CVSS 8.7 High
Mastodon: SSRF Bypass via IPv6 Unspecified Address (::)
- mastodon
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Mastodon has a consent-check bypass in its remote Collections
- mastodon
- Broken access control
- CWE-345
- CVSS 8.2 High
Mastodon: Insufficient verification of email addresses
- mastodon
- CWE-841
- CVSS 4.8 Medium
Mastodon has a denial of service for quote authorization
- mastodon
- Broken access control
- CVSS 4.3 Medium
Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>'
- mastodon
- Open redirect
- CVSS 4.6 Medium
Mastodon has SSRF via unvalidated FASP Provider base_url
- mastodon
- Server-side request forgery (SSRF)
- CVSS 4.8 Medium
Mastodon may allow unconfirmed FASP to make subscriptions
- mastodon
- Broken access control
- CVSS 6.5 Medium
Mastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via `Rails.cache`)
- mastodon
- CWE-524
- CVSS 6.5 Medium
Mastodon has insufficient access control to push notification settings
- mastodon
- Broken access control
- CVSS 4.3 Medium
Mastodon missing length limits on list names, filter names, and filter keywords
- mastodon
- Denial of service
- CVSS 7.5 High
Mastodon vulnerable to Denial of Service from a single post (client/server)
- mastodon
- Denial of service
- CVSS 5.3 Medium
Mastodon may allow a remote suspension bypass
- mastodon
- Broken access control
- CVSS 6.5 Medium
Local Mastodon users can enumerate and access severed relationships of every other local user
- mastodon
- Information disclosure
- CVSS 7.1 High
Mastodon has SSRF Protection bypass
- mastodon
- Server-side request forgery (SSRF)
- CVSS 3.7 Low
Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration
- mastodon
- CWE-204
- CVSS 4.3 Medium
Mastodon quotes control can be bypassed
- mastodon
- CWE-754
- CVSS 4.3 Medium
Mastadon streaming server allows OAuth clients without the `read` scope to subscribe to public channels
- mastodon
- CWE-280
- CVSS 4.3 Medium
Mastodon streaming API fails to disconnect disabled and suspended users
- mastodon
- CWE-273
- CWE-274
- CVSS 3.5 Low
Mastodon allows continued access after password reset via CLI
- mastodon
- Authentication bypass
- CVSS 5.3 Medium
Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails
- mastodon
- Denial of service
- CVSS 5.3 Medium
Mastodon's domain blocks & rationales ignore user approval when visibility set as "users"
- mastodon
- Information disclosure
- Broken access control
- CVSS 5.3 Medium
Mastodon's rate-limits are missing on `/auth/setup`
- mastodon
- Denial of service
- CVSS 8.2 High
Mastodon has improper authorship check on audience extension for existing posts
- mastodon
- Broken access control
- CVSS 8.5 High
Lack of media type verification of Activity Streams objects allows impersonation of remote accounts
- mastodon
- Unrestricted file upload
- CVSS 3.1 Low
Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodon
- mastodon
- Authentication bypass
- CWE-672
- CVSS 4.2 Medium
External OpenID Connect Account Takeover by E-Mail Change in mastodon
- mastodon
- Authentication bypass
- CVSS 9.4 CriticalCritical · CVSS 9+
Mastodon Remote user impersonation and takeover
- mastodon
- Authentication bypass
- CVSS 6.1 Medium
Mastodon vulnerable to Stored XSS through the translation feature
- mastodon
- Cross-site scripting (XSS)
- CVSS 7.4 High
Mastodon Invalid Domain Name Normalization vulnerability
- mastodon
- CWE-706
- CVSS 5.4 Medium
Mastodon Server-Side Request Forgery vulnerability
- mastodon
- Other injection
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
Mastodon's verified profile links can be formatted in a misleading way
- mastodon
- CWE-20
- CVSS 7.5 High
Mastodon vulnerable to Denial of Service through slow HTTP responses
- mastodon
- Denial of service
- CVSS 10.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Mastodon vulnerable to arbitrary file creation through media attachments
- mastodon
- Path traversal
- CVSS 9.3 CriticalCritical · CVSS 9+
Mastodon vulnerable to Cross-site Scripting through oEmbed preview cards
- mastodon
- Cross-site scripting (XSS)
- CVSS 7.7 High
Mastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP database
- mastodon
- Other injection