CVE-2026-22246 Local Mastodon users can enumerate and access severed relationships of every other local user

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon 4.3 added notifications of severed relationships, allowing end-users to inspect the relationships they lost as the result of a moderation action. The code allowing users to download lists of severed relationships...

CVE-2026-22246 Local Mastodon users can enumerate and access severed relationships of every other local user

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon 4.3 added notifications of severed relationships, allowing end-users to inspect the relationships they lost as the result of a moderation action. The code allowing users to download lists of severed relationships...

CVE-2026-22246

Mastodon vulnerability (CVE-2026-22246): In 4.3, the severed-relationships notification feature allowed inspecting lost relationships, but the code that downloads lists of severed relationships did not verify the list owner. As a result, any registered local user could enumerate and access the se...

EUVD-2026-1675

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon 4.3 added notifications of severed relationships, allowing end-users to inspect the relationships they lost as the result of a moderation action. The code allowing users to download lists of severed relationships...

CVE-2026-22246 Local Mastodon users can enumerate and access severed relationships of every other local user

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon 4.3 added notifications of severed relationships, allowing end-users to inspect the relationships they lost as the result of a moderation action. The code allowing users to download lists of severed relationships...

CVE-2026-22245 Mastodon has SSRF Protection bypass

Mastodon is a free, open-source social network server based on ActivityPub. By nature, Mastodon performs a lot of outbound requests to user-provided domains. Mastodon, however, has some protection mechanism to disallow requests to local IP addresses unless specified in ALLOWEDPRIVATEADDRESSES to...

CVE-2026-22245 Mastodon has SSRF Protection bypass

Mastodon is a free, open-source social network server based on ActivityPub. By nature, Mastodon performs a lot of outbound requests to user-provided domains. Mastodon, however, has some protection mechanism to disallow requests to local IP addresses unless specified in ALLOWEDPRIVATEADDRESSES to...

EUVD-2026-1674

Mastodon is a free, open-source social network server based on ActivityPub. By nature, Mastodon performs a lot of outbound requests to user-provided domains. Mastodon, however, has some protection mechanism to disallow requests to local IP addresses unless specified in ALLOWEDPRIVATEADDRESSES to...

CVE-2026-22245

CVE-2026-22245 — Mastodon SSRF protection bypass . The issue affects Mastodon releases prior to 4.5.4, 4.4.11, 4.3.17 and 4.2.29, where the local/loopback access protection for outbound HTTP requests relied on a incomplete disallowed IP ranges list. An attacker could use certain IPs to trigger re...

CVE-2026-22245 Mastodon has SSRF Protection bypass

Mastodon is a free, open-source social network server based on ActivityPub. By nature, Mastodon performs a lot of outbound requests to user-provided domains. Mastodon, however, has some protection mechanism to disallow requests to local IP addresses unless specified in ALLOWEDPRIVATEADDRESSES to...

PT-2026-2181

Name of the Vulnerable Software and Affected Versions Mastodon versions 4.2.29, 4.3.17, 4.4.11, and 4.5.4 Description Mastodon is a social network server that makes outbound requests to user-provided domains. A protection mechanism exists to disallow requests to local IP addresses, intended to...

Mastodon 代码问题漏洞

Mastodon is an open source social networking server based on ActivityPub by Mastodon Open Source. A code issue vulnerability exists in Mastodon versions prior to 4.5.4, prior to 4.4.11, prior to 4.3.17, and prior to 4.2.29, which stems from the lack of an IP address range restriction that could...

Mastodon 安全漏洞

Mastodon is an open source social networking server based on ActivityPub by Mastodon Open Source. A security vulnerability exists in Mastodon versions prior to 4.3.17, prior to 4.4.11, and prior to 4.5.4, which stems from a lack of relationship list ownership checking and could lead to informatio...

PT-2026-2182

Name of the Vulnerable Software and Affected Versions Mastodon versions 4.3 through 4.3.16 Mastodon versions 4.4 through 4.4.10 Mastodon versions 4.5 through 4.5.3 Description Mastodon is a free, open-source social network server based on ActivityPub. A flaw exists in the code handling the downlo...

CVE-2025-14346

creationtimestamp| type| source ---|---|--- 2026-01-05 16:51:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mbovkacx7t2m 2026-01-05 17:01:58+00:00| published-proof-of-concept| Telegram/JG0illfmG2L7l4ptINREGxlmvgbv5gaPTQ3AaWMoCQe-I 2026-01-05 17:03:39+00:00| seen|...

GHSA-84H7-RJJ3-6JX4

creationtimestamp| type| source ---|---|--- 2025-12-15 17:55:01+00:00| seen| https://mastodon.social/users/chrisvest/statuses/115724864576648010...

CVE-2025-67735

creationtimestamp| type| source ---|---|--- 2025-12-15 14:39:48+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4 2025-12-15 17:55:00+00:00| seen| https://mastodon.social/users/chrisvest/statuses/115724864576648010 2026-01-13 15:10:13+00:00|...

CVE-2025-67500

Mastodon is a free, open-source social network server based on ActivityPub. Versions 4.2.27 and prior, 4.3.0-beta.1 through 4.3.14, 4.4.0-beta.1 through 4.4.9, 4.5.0-beta.1 through 4.5.2 have discrepancies in error handling which allow checking whether a given status exists by sending a request...

BIT-MASTODON-2025-67500 Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration

Mastodon is a free, open-source social network server based on ActivityPub. Versions 4.2.27 and prior, 4.3.0 through 4.3.14, 4.4.0 through 4.4.9, 4.5.0 through 4.5.2 have discrepancies in error handling which allow checking whether a given status exists by sending a request with a non-English...

CVE-2025-67500

Mastodon is a free, open-source social network server based on ActivityPub. Versions 4.2.27 and prior, 4.3.0-beta.1 through 4.3.14, 4.4.0-beta.1 through 4.4.9, 4.5.0-beta.1 through 4.5.2 have discrepancies in error handling which allow checking whether a given status exists by sending a request...