Mastodon Prototype Pollution Vulnerability

The GitHub repository mastodon/mastodon prior to 3.5.0 contains a Prototype Pollution vulnerability. id: CVE-2022-0432 info: name: Mastodon Prototype Pollution Vulnerability author: pikpikcu severity: medium description: The GitHub repository mastodon/mastodon prior to 3.5.0 contains a Prototype...

Mastodon - Open Redirect

Mastodon version 4.5.8, 4.4.15, 4.3.21 is vulnerable to unauthenticated Open Redirect vulnerability CWE-601 exists in the /web/ route due to improper handling of URL-encoded path segments. id: CVE-2026-33868 info: name: Mastodon - Open Redirect author: theamanrawat severity: medium description: |...

CVE-2026-18290

creationtimestamp| type| source ---|---|--- 2026-08-21 12:07:43+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mtlpxwzwki2i 2026-08-21 12:07:50+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117133414439759245...

CVE-2026-59825

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldapauthenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULTPARAMS when LDAP authentication uses LDAPTLSNOVERIFY=true, disabling SSL and T...

CVE-2026-59825

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldapauthenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULTPARAMS when LDAP authentication uses LDAPTLSNOVERIFY=true, disabling SSL and T...

CVE-2026-59825 Mastodon: Unwanted deactivation of SSL/TLS certificate verification

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldapauthenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULTPARAMS when LDAP authentication uses LDAPTLSNOVERIFY=true, disabling SSL and T...

CVE-2026-59825 Mastodon: Unwanted deactivation of SSL/TLS certificate verification

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldapauthenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULTPARAMS when LDAP authentication uses LDAPTLSNOVERIFY=true, disabling SSL and T...

EUVD-2026-60953

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldapauthenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULTPARAMS when LDAP authentication uses LDAPTLSNOVERIFY=true, disabling SSL and T...

CVE-2026-59825

When LDAP auth uses LDAP_TLS_NO_VERIFY=true, app/models/concerns/user/ldap_authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT_PARAMS, disabling SSL/TLS verification globally for puma web processes. This enables MITM attacks against all puma-originated HTTPS requests. Fixed in Mastodon 4.4...

CVE-2026-59825 Mastodon: Unwanted deactivation of SSL/TLS certificate verification

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldapauthenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULTPARAMS when LDAP authentication uses LDAPTLSNOVERIFY=true, disabling SSL and T...

PT-2026-77143

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldap authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT PARAMS when LDAP authentication uses LDAP TLS NO VERIFY=true, disabling SSL...

BIT-MASTODON-2026-72916 Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0, PrivateAddressCheck.privateaddress? in app/lib/privateaddresscheck.rb normalized IPv4-mapped IPv6 addresses but did not recognize IPv4-compatible IPv6 addresses with...

BIT-MASTODON-2026-72915 Mastodon: Personally-identifying information disclosure due to incorrect access control validation

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0 until 4.6.4 and 4.7.0, any logged-in local user could use the show action in app/controllers/admin/collectionscontroller.rb to access personally identifying information about another local user in a collection...

BIT-MASTODON-2026-72914 Mastodon: Exhausting data by an unauthenticated request to the admin retention API

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive...

CVE-2026-72915

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collectionscontroller.rb to access personally identifying information about another local user in...

CVE-2026-72914

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning...

CVE-2026-72916

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.privateaddress? in app/lib/privateaddresscheck.rb normalized IPv4-mapped IPv6 addresses but did not recognize IPv4-compatible IPv6 addresses with...

CVE-2026-72916 Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.privateaddress? in app/lib/privateaddresscheck.rb normalized IPv4-mapped IPv6 addresses but did not recognize IPv4-compatible IPv6 addresses with...

CVE-2026-72916

Mastodon CVE-2026-72916 affects PrivateAddressCheck.private_address? in app/lib/private_address_check.rb, which incorrectly normalized IPv4-mapped IPv6 addresses and did not recognize IPv4-compatible IPv6 addresses with IPAddr#ipv4_compat?. This allowed an attacker to bypass ALLOWED_PRIVATE_ADDRE...

CVE-2026-72916 Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.privateaddress? in app/lib/privateaddresscheck.rb normalized IPv4-mapped IPv6 addresses but did not recognize IPv4-compatible IPv6 addresses with...