CVE-2023-36460

CVE-2023-36460 affects Mastodon before the patches: 3.5.0–3.5.8, 4.0.0–4.0.4, and 4.1.0–4.1.2. A media processing flaw allows crafted media files to cause arbitrary files to be created or overwritten at any location the instance can access, enabling Denial of Service and arbitrary Remote Code Exe...

CVE-2024-25618

CVE-2024-25618 (Mastodon) describes an account takeover risk when external identity providers (CAS, SAML, OIDC) attach new identities to existing Mastodon users via shared email addresses. The issue occurs if the provider allows changing a user’s email (or supports multiple providers) and Mastodo...

CVE-2018-21018

CVE-2018-21018 affects Mastodon prior to 2.6.3. The issue is described as mishandling timeouts of incompletely established sessions, with CVSS metrics indicating HIGH to CRITICAL impact (CVSS 2.0: 7.5; CVSS 3.1: 9.8). Affected software is Mastodon before 2.6.3; the root cause relates to session t...

CVE-2024-34535

CVE-2024-34535 affects Mastodon 4.1.6. The issue allows bypassing API endpoint rate limiting by sending a crafted HTTP request header. Impact is described as potential exposure of higher-level access due to rate-limiting bypass, with CVSSv3.1 indicating Network attack, High confidentiality impact...

CVE-2022-0432

Mastodon prior to 3.5.0 is affected by a Prototype Pollution vulnerability. The issue arises in the Mastodon repository where untrusted data can pollute the prototype of built-in objects (as detailed in the Nuclei template and CVE entry for CVE-2022-0432). Impact notes indicate potential remote c...

CVE-2025-27399

Summary: Mastodon contains an access-control bug where, when domain blocks/reasons visibility is set to the English string “To logged-in users,” users not yet approved can view the block reasons. Affected versions: before 4.1.23, 4.2.16, and 4.3.4. Impact: instance admins who rely on private doma...

CVE-2024-37903

CVE-2024-37903 (Mastodon) affects Mastodon self-hosted/federated platform. The issue allows an attacker to extend the audience of a post they do not own to other Mastodon users on a target server, potentially gaining access to the post contents. This occurs in affected versions from 2.6.0 up to 4...

CVE-2024-25619

CVE-2024-25619 affects Mastodon releases 4.2.6, 4.1.14, 4.0.14, and 3.5.18. Root cause: Doorkeeper’s relationship between Applications and Access Tokens used dependent: delete_all, so the after_commit callback on AccessTokenExtension did not fire, leaving the streaming server informed of destroye...

CVE-2022-31263

Summary: The CVE affects Mastodon prior to 3.5.0, specifically the file app/models/user.rb, which enables bypassing email-restriction checks. The issue is tied to the Mastodon version prior to 3.5.0 and is not described with exploit details in the provided documents. Root cause / impact: A bypass...

CVE-2022-2166

CVE-2022-2166 affects mastodon/mastodon versions prior to 4.0.0. The vulnerability is described as improper restriction of excessive authentication attempts, with a CVSS v3.1 base score of 9.8 (critical) affecting confidentiality, integrity, and availability. Concrete details in connected docs co...

CVE-2022-48364

Summary: CVE-2022-48364 affects Mastodon 3.5.x before 3.5.3. The vulnerability resides in the undo_mark_statuses_as_sensitive method of app/services/approve_appeal_service.rb, which does not use the server’s representative account, causing moderator identity disclosure when a moderator approves a...

CVE-2024-23832

Mastodon Remote user impersonation and takeover (CVE-2024-23832) affects multiple release lines prior to specific patch levels due to insufficient origin validation when LDAP is used for authentication. Affected components are Mastodon server implementations where LDAP-based authentication can be...

CVE-2023-42451

CVE-2023-42451 affects Mastodon: prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, there is a flaw in domain name normalization that can allow attackers to spoof domains they do not own under certain circumstances. A patch exists in versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2. The root ca...

CVE-2023-42452

Mastodon CVE-2023-42452 affects 4.x branches prior to 4.0.10, 4.2.8, and 4.2.0-rc2. The issue allows Stored XSS via the translation feature by bypassing server-side HTML sanitization and executing unescaped HTML in the browser. Exploitation requires user interaction (clicking the Translate button...

CVE-2022-46405

CVE-2022-46405 affects Mastodon up to version 4.0.2. The issue enables denial-of-service by creating bot accounts that follow attacker-controlled accounts on servers with a wildcard DNS A record, causing uncontrolled recursion of attacker-generated messages and an enlarged Sidekiq pull queue. Aff...

CVE-2025-27157

Mastodon rate-limits are missing on /auth/setup in versions 4.2.0–4.2.15 and 4.3.0–4.3.3, enabling an attacker to craft requests that send emails to arbitrary addresses. The issue is fixed in 4.2.16 and 4.3.4. This CVE description documents the affected versions and the remediation. If exploiting...

CVE-2026-23963

CVE-2026-23963 affects Mastodon prior to versions 4.5.5, 4.4.12, and 4.3.18 where there is no maximum length enforcement for list names, filter names, or filter keywords. This can enable a local user to craft arbitrarily long strings, leading to disproportionate storage and compute resource usage...

CVE-2023-42450

Mastodon (ActivityPub-based) is affected in versions up to 4.2.0-rc2 where crafting specific input can inject arbitrary data into HTTP requests issued by the server. The issue enables confused deputy attacks if ALLOWED_PRIVATE_ADDRESSES permits access to local exploitable services. A patch exists...

CVE-2023-49952

Concerning CVE-2023-49952, multiple trusted sources confirm a vulnerability in Mastodon 4.1.x pre-4.1.17 and 4.2.x pre-4.2.9 that allows bypassing rate limiting via a crafted HTTP request header. The root cause is not detailed beyond the bypass of rate limiting; affected versions include Mastodon...

CVE-2024-25623

CVE-2024-25623 describes a lack of verification of the Activity Streams Content-Type when Mastodon fetches remote statuses, enabling impersonation of accounts on remote servers that allow registering and arbitrary user uploads. Affected versions are prior to 4.2.7, 4.1.15, 4.0.15, and 3.5.19. The...

CVE-2026-25540

Mastodon prior to versions 4.3.19, 4.4.13, and 4.5.6 is vulnerable to web cache poisoning in Rails.cache when AUTHORIZED_FETCH is enabled. The ActivityPub endpoints for pinned posts and featured hashtags cache responses that depend on the signer’s account, but the internal cache reuse does not re...

CVE-2022-24307

Mastodon prior to 3.3.2 and 3.4.x prior to 3.4.6 suffers from an access-control weakness due to not compacting incoming signed JSON-LD activities, despite JSON-LD signing being supported since 1.6.0. This affects versions 1.6.0–3.3.2 and 3.4.x–3.4.5, enabling potential improper access handling as...

CVE-2023-36459

CVE-2023-36459 affects Mastodon: injection bypasses HTML sanitization via crafted oEmbed data, enabling XSS in preview cards. Affected versions are prior to 3.5.9, 4.0.5, and 4.1.3. The issue is mitigated by upgrading to 3.5.9, 4.0.5, or 4.1.3 where a patch exists.

CVE-2023-36461

Summary: Mastodon is vulnerable to a Denial of Service via slow HTTP responses due to slowloris-type attacks when performing outgoing HTTP queries. The root cause is that, prior to 3.5.9, 4.0.5, and 4.1.3, Mastodon could allow the duration of a response to be extended indefinitely by a malicious ...

CVE-2023-28853

Mastodon is affected by an LDAP injection vulnerability in the login path. The issue arises from insecure LDAP queries during authentication, enabling an attacker to leak arbitrary attributes from the LDAP directory. Affected versions are 2.5.0 up to, but not including, 3.5.8, 4.0.4, and 4.1.2. R...

CVE-2023-36462

Summary of CVE-2023-36462 (Mastodon) : A vulnerability in Mastodon (ActivityPub) allows an attacker to craft a verified profile link with specific formatting that conceals parts of the URL, making it appear to link to a different destination. The issue is visually misleading, and clicking reveals...

CVE-2025-54879

CVE-2025-54879 affects Mastodon when using the email-based confirmation throttle. The root cause is a misconfiguration in Mastodon’s rate-limiting: the email throttle checks the password-reset path instead of the confirmation path, effectively disabling per-email limits for confirmation requests....

CVE-2026-23961

Summary of CVE-2026-23961 (Mastodon): A logic flaw in how suspended remote users are handled allows old posts from those users to appear in timelines, and under some circumstances, newly created posts from suspended users can be processed and surfaced. Affected releases span multiple lines: v4.5....

CVE-2026-33868

Mastodon is affected by an unauthenticated Open Redirect (CWE-601) in the /web/* route prior to versions 4.5.8, 4.4.15, and 4.3.21. The root cause is improper handling of URL-encoded path segments, where encoded slashes (%2F) bypass Rails path normalization and are treated as host-relative redire...

CVE-2026-41259

CVE-2026-41259 affects Mastodon prior to versions 4.5.9, 4.4.16, and 4.3.22. The issue is insufficient verification of email addresses: Mastodon allows restricting new user sign-up by domain but does not properly handle characters that some mail servers interpret differently. Root cause is incomp...

CVE-2026-33869

Mastodon vulnerability CVE-2026-33869 affects the 4.5.x branch (before 4.5.8) and the 4.4.x branch (before 4.4.15). An attacker who knows of a quote before it reaches a server can cause the server to misprocess it, resulting in a denial of service for quote authorization. The issue does not affec...

CVE-2026-27477

Mastodon CVE-2026-27477 describes an SSRF risk in the FASP feature: unauthenticated registration of a FASP with a base_url that can resolve to an internal address, when the server has EXPERIMENTAL_FEATURES including fasp enabled. Affected: Mastodon versions 4.4.0–4.4.13 and 4.5.0–4.5.6. Impact: s...

CVE-2026-22245

CVE-2026-22245 — Mastodon SSRF protection bypass . The issue affects Mastodon releases prior to 4.5.4, 4.4.11, 4.3.17 and 4.2.29, where the local/loopback access protection for outbound HTTP requests relied on a incomplete disallowed IP ranges list. An attacker could use certain IPs to trigger re...

CVE-2026-23962

Mastodon is vulnerable to Denial of Service due to an unlimited maximum number of poll options for remote posts in versions before v4.3.18, v4.4.12, and v4.5.5. The underlying issue allows an attacker to create polls with a very large number of options, leading to disproportionate resource usage ...

CVE-2025-62174

Summary: Mastodon prior to versions 4.4.6, 4.3.14, and 4.2.27 fails to revoke active sessions and access tokens when an admin resets a user password via the CLI command bin/tootctl accounts modify --reset-password, allowing continued use of the account by an attacker with a compromised session/to...

CVE-2026-27468

CVE-2026-27468 (Mastodon) affects Mastodon servers that have enabled the experimental FASP feature via EXPERIMENTAL_FEATURES including “fasp”. In versions 4.4.0–4.4.13 and 4.5.0–4.5.6, actions by a FASP to subscribe to account/content lifecycle events or to backfill content did not verify adminis...

CVE-2025-67500

CVE-2025-67500 affects Mastodon prior to fixed versions: 4.2.28, 4.3.15, 4.4.10 and 4.5.3. The issue stems from error-handling discrepancies that let an attacker determine whether a private status exists by sending a request with a non-English Accept-Language header; it does not reveal the status...

CVE-2026-22246

Mastodon vulnerability (CVE-2026-22246): In 4.3, the severed-relationships notification feature allowed inspecting lost relationships, but the code that downloads lists of severed relationships did not verify the list owner. As a result, any registered local user could enumerate and access the se...

CVE-2026-23964

Mastodon vendor: Mastodon server (ActivityPub). Vulnerability CVE-2026-23964 is an insecure direct object reference in the web push subscription update endpoint affecting versions < 4.5.5, < 4.4.12, and

CVE-2025-62175

Mastodon has a vulnerability in streaming API handling: in versions < 4.4.6, < 4.3.14, and

CVE-2025-62176

Summary : The Mastodon streaming server vulnerability CVE-2025-62176 allows OAuth clients lacking the read:statuses scope to subscribe to public timelines by using any valid authentication token. Affected versions : prior to 4.4.6, 4.3.14, and 4.2.27. Root cause : streaming server accepts events ...

CVE-2025-62605

Mastodon quotes control bypass vulnerability (CVE-2025-62605) affects 4.4.x and earlier 4.5.0-beta.2 where reblogging a post and quoting the reblog could display a preview of a post without authorization due to how reblogs are treated as statuses. Patches exist in 4.4.8 and 4.5.0-beta.2, which mi...