Joinmastodon Mastodon vulnerabilities

• joinmastodon mastodon Mastodon: Insufficient verification of email addresses CVE-2026-41259 Fix available 8.2 HighApril 23, 2026
• joinmastodon mastodon Mastodon has a denial of service for quote authorization CVE-2026-33869 Fix available 4.8 MediumMarch 27, 2026
• joinmastodon mastodon Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>' CVE-2026-33868 Fix available 4.3 MediumMarch 27, 2026
• joinmastodon mastodon Mastodon has SSRF via unvalidated FASP Provider base_url CVE-2026-27477 Fix available 4.6 MediumFebruary 24, 2026
• joinmastodon mastodon Mastodon may allow unconfirmed FASP to make subscriptions CVE-2026-27468 Fix available 4.8 MediumFebruary 24, 2026
• joinmastodon mastodon Mastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via `Rails.cache`) CVE-2026-25540 Fix available 6.5 MediumFebruary 4, 2026
• joinmastodon mastodon Mastodon has insufficient access control to push notification settings CVE-2026-23964 Fix available 6.5 MediumJanuary 22, 2026
• joinmastodon mastodon Mastodon missing length limits on list names, filter names, and filter keywords CVE-2026-23963 Fix available 4.3 MediumJanuary 22, 2026
• joinmastodon mastodon Mastodon vulnerable to Denial of Service from a single post (client/server) CVE-2026-23962 Fix available 7.5 HighJanuary 22, 2026
• joinmastodon mastodon Mastodon may allow a remote suspension bypass CVE-2026-23961 Fix available 5.3 MediumJanuary 22, 2026
• joinmastodon mastodon Local Mastodon users can enumerate and access severed relationships of every other local user CVE-2026-22246 Fix available 6.5 MediumJanuary 8, 2026
• joinmastodon mastodon Mastodon has SSRF Protection bypass CVE-2026-22245 Fix available 7.1 HighJanuary 8, 2026
• joinmastodon mastodon Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration CVE-2025-67500 Fix available 3.7 LowDecember 9, 2025
• joinmastodon mastodon Mastodon quotes control can be bypassed CVE-2025-62605 Fix available 4.3 MediumOctober 21, 2025
• joinmastodon mastodon Mastadon streaming server allows OAuth clients without the `read` scope to subscribe to public channels CVE-2025-62176 Fix available 4.3 MediumOctober 13, 2025
• joinmastodon mastodon Mastodon streaming API fails to disconnect disabled and suspended users CVE-2025-62175 Fix available 4.3 MediumOctober 13, 2025
• joinmastodon mastodon Mastodon allows continued access after password reset via CLI CVE-2025-62174 Fix available 3.5 LowOctober 13, 2025
• joinmastodon mastodon Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails CVE-2025-54879 Fix available 5.3 MediumAugust 5, 2025
• joinmastodon mastodon Mastodon's domain blocks & rationales ignore user approval when visibility set as "users" CVE-2025-27399 Fix available 5.3 MediumFebruary 27, 2025
• joinmastodon mastodon Mastodon's rate-limits are missing on `/auth/setup` CVE-2025-27157 Fix available 5.3 MediumFebruary 27, 2025
• joinmastodon mastodon Mastodon 4.1.x before 4.1.17 and 4.2.x before 4.2.9 allows a bypass of rate limiting via a crafted HTTP request header. CVE-2023-49952 Fix available 7.5 HighNovember 18, 2024
• joinmastodon mastodon In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request... CVE-2024-34535 Fix available 5.9 MediumOctober 3, 2024
• joinmastodon mastodon Mastodon has improper authorship check on audience extension for existing posts CVE-2024-37903 Fix available 8.2 HighJuly 5, 2024
• joinmastodon mastodon Lack of media type verification of Activity Streams objects allows impersonation of remote accounts CVE-2024-25623 Fix available 8.5 HighFebruary 19, 2024
• joinmastodon mastodon Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodon CVE-2024-25619 Fix available 3.1 LowFebruary 14, 2024
• joinmastodon mastodon External OpenID Connect Account Takeover by E-Mail Change in mastodon CVE-2024-25618 Fix available 4.2 MediumFebruary 14, 2024
• joinmastodon mastodon Mastodon Remote user impersonation and takeover CVE-2024-23832 Fix available 9.4 CriticalFebruary 1, 2024
• joinmastodon mastodon Mastodon vulnerable to Stored XSS through the translation feature CVE-2023-42452 Fix available 6.1 MediumSeptember 19, 2023
• joinmastodon mastodon Mastodon Invalid Domain Name Normalization vulnerability CVE-2023-42451 Fix available 7.4 HighSeptember 19, 2023
• joinmastodon mastodon Mastodon Server-Side Request Forgery vulnerability CVE-2023-42450 Fix available 5.4 MediumSeptember 19, 2023
• joinmastodon mastodon Mastodon's verified profile links can be formatted in a misleading way CVE-2023-36462 Fix available 5.4 MediumJuly 6, 2023
• joinmastodon mastodon Mastodon vulnerable to Denial of Service through slow HTTP responses CVE-2023-36461 Fix available 7.5 HighJuly 6, 2023
• joinmastodon mastodon Mastodon vulnerable to arbitrary file creation through media attachments CVE-2023-36460 Fix available EPSS 40.1% 10.0 CriticalJuly 6, 2023
• joinmastodon mastodon Mastodon vulnerable to Cross-site Scripting through oEmbed preview cards CVE-2023-36459 Fix available 9.3 CriticalJuly 6, 2023
• joinmastodon mastodon Mastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP database CVE-2023-28853 Fix available 7.7 HighApril 4, 2023
• joinmastodon mastodon The undo_mark_statuses_as_sensitive method in app/services/approve_appeal_service.rb in Mastodon... CVE-2022-48364 Fix available 4.3 MediumMarch 6, 2023
• joinmastodon mastodon Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue)... CVE-2022-46405 Fix available 7.5 HighDecember 4, 2022
• joinmastodon mastodon, mastodon mastodon/mastodon +1 more Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon CVE-2022-2166 Fix available 9.8 CriticalNovember 16, 2022
• joinmastodon mastodon app/models/user.rb in Mastodon before 3.5.0 allows a bypass of e-mail restrictions. CVE-2022-31263 Fix available 5.3 MediumMay 24, 2022
• joinmastodon mastodon Mastodon before 3.3.2 and 3.4.x before 3.4.6 has incorrect access control because it does not... CVE-2022-24307 Fix available 9.8 CriticalFebruary 3, 2022
• joinmastodon mastodon, mastodon mastodon/mastodon +1 more Prototype Pollution in mastodon/mastodon CVE-2022-0432 Fix available 7.4 HighFebruary 2, 2022
• joinmastodon mastodon Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions. CVE-2018-21018 9.8 CriticalSeptember 22, 2019