1216 matches found
CVE-2026-72916 Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.privateaddress? in app/lib/privateaddresscheck.rb normalized IPv4-mapped IPv6 addresses but did not recognize IPv4-compatible IPv6 addresses with...
CVE-2026-72915 Mastodon: Personally-identifying information disclosure due to incorrect access control validation
Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collectionscontroller.rb to access personally identifying information about another local user in...
CVE-2026-72915 Mastodon: Personally-identifying information disclosure due to incorrect access control validation
Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collectionscontroller.rb to access personally identifying information about another local user in...
CVE-2026-72915
CVE-2026-72915 affects Mastodon versions 4.6.0-beta.1 through 4.6.4 and 4.7.0-beta.1, where a logged-in local user could access PII of another local user via the show action in app/controllers/admin/collections_controller.rb. The vulnerability stems from the controller using the general collectio...
EUVD-2026-55838
Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collectionscontroller.rb to access personally identifying information about another local user in...
CVE-2026-72914 Mastodon: Exhausting data by an unauthenticated request to the admin retention API
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning...
EUVD-2026-55837
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning...
CVE-2026-72914
Mastodon prior to versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1 exposes a resource exhaustion risk via administrative statistics endpoints (Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController). Anonymous callers can pass keys, start_at, and end_at to trigger long-running...
CVE-2026-72914 Mastodon: Exhausting data by an unauthenticated request to the admin retention API
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning...
CVE-2026-71946
creationtimestamp| type| source ---|---|--- 2026-08-10 11:09:12+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mspxl6c7yy2k 2026-08-10 11:09:15+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117070898926234227...
PT-2026-69984
Name of the Vulnerable Software and Affected Versions Mastodon versions 4.6.0-beta.1 through 4.6.3 Mastodon version 4.7.0-beta.1 Description An incorrect access control validation in the show action within app/controllers/admin/collections controller.rb allows any logged-in local user to access...
PT-2026-69983
Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.4.21 Mastodon versions prior to 4.5.14 Mastodon versions prior to 4.6.4 Mastodon versions prior to 4.7.0-beta.1 Description Administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and...
PT-2026-69985
Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.4.21 Mastodon versions prior to 4.5.14 Mastodon versions prior to 4.6.4 Mastodon versions prior to 4.7.0-beta.1 Description A Server-Side Request Forgery SSRF protection bypass exists in the...
CVE-2026-71987
creationtimestamp| type| source ---|---|--- 2026-08-09 17:07:38+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mso356gyk22h 2026-08-09 17:07:46+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117066646033425511...
CVE-2026-56793
creationtimestamp| type| source ---|---|--- 2026-08-09 15:04:41+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117066162544319010 2026-08-09 15:04:41+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3msnubd3w252d...
CVE-2026-71947
creationtimestamp| type| source ---|---|--- 2026-08-09 14:02:02+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117065912163705973...
CVE-2026-61808
creationtimestamp| type| source ---|---|--- 2026-08-08 23:02:55+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117062371312979622...
CVE-2026-20346
creationtimestamp| type| source ---|---|--- 2026-08-08 15:03:35+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117060495821023885 2026-08-10 12:45:08+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-clamav-2 2026-08-10 13:20:07+00:00| seen|...
CVE-2026-19195
creationtimestamp| type| source ---|---|--- 2026-08-08 12:06:35+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117059799868254552 2026-08-09 05:00:03+00:00| seen| https://t.me/GithubRedTeam/97246 2026-08-09 14:02:14+00:00| published-proof-of-concept|...