{"id":"CVE-2024-37903","aliases":["BIT-mastodon-2024-37903","EUVD-2024-36876","GHSA-xjvf-fm67-4qc3"],"status":"published","title":"Mastodon has improper authorship check on audience extension for existing posts","description":"Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting specific activities, an attacker can extend the audience of a post they do not own to other Mastodon users on a target server, thus gaining access to the contents of a post not intended for them. Versions 4.1.18 and 4.2.10 contain a patch for this issue.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0053,"percentile":0.45284,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2024-07-05T17:24:49Z","modified":"2026-10-28T02:31:09Z","fixes":[{"ecosystem":"Bitnami","package":"mastodon","fixed_in":["4.1.18","4.2.10"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"mastodon","ranges":[{"type":"SEMVER","events":[{"introduced":"2.6.0"},{"fixed":"4.1.18"},{"introduced":"4.2.0"},{"fixed":"4.2.10"}]}]}],"products":[{"vendor":"joinmastodon","product":"mastodon"},{"vendor":"mastodon","product":"mastodon"}],"references":[{"url":"https://github.com/mastodon/mastodon/security/advisories/GHSA-xjvf-fm67-4qc3","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://github.com/mastodon/mastodon/commit/a1c7aae28aecf06659c5b18cfa131b37cd1512a3","tags":["x_refsource_MISC","x_transferred","Patch","fix"]},{"url":"https://github.com/mastodon/mastodon/commit/d4bf22b632ea8b1174375c4966a6768ab66393b6","tags":["x_refsource_MISC","x_transferred","Patch","fix"]},{"url":"https://github.com/mastodon/mastodon/releases/tag/v4.1.18","tags":["x_refsource_MISC","x_transferred","Release Notes","article","web"]},{"url":"https://github.com/mastodon/mastodon/releases/tag/v4.2.10","tags":["x_refsource_MISC","x_transferred","Release Notes","article","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37903","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37903.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-37903","title":"Mastodon has improper authorship check on audience extension for existing posts","description":"Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting specific activities, an attacker can extend the audience of a post they do not own to other Mastodon users on a target server, thus gaining access to the contents of a post not intended for them. Versions 4.1.18 and 4.2.10 contain a patch for this issue.","status":"published","published":"2024-07-05T17:24:49.213Z","modified":"2024-08-02T04:04:23.423Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:34:00.585327Z"}],"euvd":[{"id":"EUVD-2024-36876","description":"Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting specific activities, an attacker can extend the audience of a post they do not own to other Mastodon users on a target server, thus gaining access to the contents of a post not intended for them. Versions 4.1.18 and 4.2.10 contain a patch for this issue.","status":"published","published":"2024-07-05T17:24:49Z","modified":"2024-08-02T04:04:23Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-03T03:50:18.901913Z"}],"nvd":[{"id":"CVE-2024-37903","description":"Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting specific activities, an attacker can extend the audience of a post they do not own to other Mastodon users on a target server, thus gaining access to the contents of a post not intended for them. Versions 4.1.18 and 4.2.10 contain a patch for this issue.","status":"published","published":"2024-07-05T18:15:32.093Z","modified":"2026-06-17T07:39:01.237Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:10:10.545705Z"}],"osv":[{"id":"CVE-2024-37903","title":"Mastodon has improper authorship check on audience extension for existing posts","description":"Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting specific activities, an attacker can extend the audience of a post they do not own to other Mastodon users on a target server, thus gaining access to the contents of a post not intended for them. Versions 4.1.18 and 4.2.10 contain a patch for this issue.","status":"published","published":"2024-07-05T17:24:49.213Z","modified":"2026-10-28T02:31:09.813577837Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:44:41.133403Z"},{"id":"BIT-mastodon-2024-37903","title":"Mastodon has improper authorship check on audience extension for existing posts","description":"Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting specific activities, an attacker can extend the audience of a post they do not own to other Mastodon users on a target server, thus gaining access to the contents of a post not intended for them. Versions 4.1.18 and 4.2.10 contain a patch for this issue.","status":"published","published":"2024-07-09T07:24:52.373Z","modified":"2026-09-08T08:48:12.921314871Z","updated_at":"2026-11-02T15:28:32.645004Z"}]}}