{"id":"CVE-2026-72914","aliases":["BIT-mastodon-2026-72914","EUVD-2026-55837","GHSA-7jvv-fhmg-wpfw"],"status":"published","title":"Mastodon: Exhausting data by an unauthenticated request to the admin retention API","description":"Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive calculations. Anonymous callers could submit keys, start_at, and end_at parameters that caused long-running SQL queries in Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension, allowing repeated requests to exhaust server resources. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00827,"percentile":0.57931,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-405","CWE-770"],"published":"2026-08-10T21:13:20Z","modified":"2026-10-28T02:31:00Z","fixes":[{"ecosystem":"Bitnami","package":"mastodon","fixed_in":["4.4.21","4.5.14","4.6.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"mastodon","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.4.21"},{"introduced":"4.5.0"},{"fixed":"4.5.14"},{"introduced":"4.6.0"},{"fixed":"4.6.4"}]}]}],"products":[{"vendor":"mastodon","product":"mastodon"}],"references":[{"url":"https://github.com/mastodon/mastodon/security/advisories/GHSA-7jvv-fhmg-wpfw","tags":["x_refsource_CONFIRM","web","advisory"]},{"url":"https://github.com/mastodon/mastodon/commit/18c61f286f1f5718a8f517940ba384866ffa3892","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/mastodon/mastodon/commit/467c933459c7d0e5513475b9e4888afaedfb1074","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/mastodon/mastodon/commit/930aa9fee26bf9eaefe27826fa1061288d83373b","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/mastodon/mastodon/commit/da47a1bd3cd07935d7ca55a1f4f1a76f7f167e0d","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/mastodon/mastodon/releases/tag/v4.4.21","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/mastodon/mastodon/releases/tag/v4.5.14","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/mastodon/mastodon/releases/tag/v4.6.4","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/mastodon/mastodon/releases/tag/v4.7.0-beta.1","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72914","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72914.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-72914","title":"Mastodon: Exhausting data by an unauthenticated request to the admin retention API","description":"Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive calculations. Anonymous callers could submit keys, start_at, and end_at parameters that caused long-running SQL queries in Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension, allowing repeated requests to exhaust server resources. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.","status":"published","published":"2026-08-10T21:13:20.856Z","modified":"2026-08-11T13:24:54.383Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-405","CWE-770"],"updated_at":"2026-11-02T14:19:51.663093Z"}],"euvd":[{"id":"EUVD-2026-55837","description":"Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive calculations. Anonymous callers could submit keys, start_at, and end_at parameters that caused long-running SQL queries in Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension, allowing repeated requests to exhaust server resources. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.","status":"published","published":"2026-08-10T21:13:20Z","modified":"2026-08-11T13:24:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:00.294626Z"}],"nvd":[{"id":"CVE-2026-72914","description":"Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive calculations. Anonymous callers could submit keys, start_at, and end_at parameters that caused long-running SQL queries in Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension, allowing repeated requests to exhaust server resources. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.","status":"published","published":"2026-08-10T22:17:10.193Z","modified":"2026-09-09T20:55:04.493Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-405","CWE-770"],"updated_at":"2026-11-02T14:12:36.102748Z"}],"osv":[{"id":"CVE-2026-72914","title":"Mastodon: Exhausting data by an unauthenticated request to the admin retention API","description":"Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive calculations. Anonymous callers could submit keys, start_at, and end_at parameters that caused long-running SQL queries in Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension, allowing repeated requests to exhaust server resources. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.","status":"published","published":"2026-08-10T21:13:20.856Z","modified":"2026-10-28T02:31:00.256792885Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-405","CWE-770"],"updated_at":"2026-11-02T15:45:15.88521Z"},{"id":"BIT-mastodon-2026-72914","title":"Mastodon: Exhausting data by an unauthenticated request to the admin retention API","description":"Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive calculations. Anonymous callers could submit keys, start_at, and end_at parameters that caused long-running SQL queries in Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension, allowing repeated requests to exhaust server resources. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0.","status":"published","published":"2026-08-17T05:46:36.585Z","modified":"2026-08-17T08:10:44.107969763Z","updated_at":"2026-11-02T15:28:32.645004Z"}]}}