Mastodon vulnerabilities

Products

• Mastodon 44
• Mastodon/mastodon 2

Newest

• mastodon Mastodon: Unwanted deactivation of SSL/TLS certificate verification CVE-2026-59825 Fix available 7.4 HighAugust 18, 2026
• mastodon Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses CVE-2026-72916 Fix available 6.3 MediumAugust 10, 2026
• mastodon Mastodon: Personally-identifying information disclosure due to incorrect access control validation CVE-2026-72915 Fix available 7.5 HighAugust 10, 2026
• mastodon Mastodon: Exhausting data by an unauthenticated request to the admin retention API CVE-2026-72914 Fix available 7.5 HighAugust 10, 2026
• mastodon Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH_TRANSFORMER CVE-2026-50129 Fix available 7.5 HighJune 24, 2026
• mastodon Mastodon: Spoofing of attribution domains CVE-2026-50128 Fix available 5.3 MediumJune 24, 2026
• mastodon Mastodon: Removal of integrity-protected JSON entries from signed activities CVE-2026-48028 Fix available 6.5 MediumJune 24, 2026
• mastodon Mastodon: SSRF protection bypass on older Ruby versions CVE-2026-47389 Fix available 8.6 HighJune 24, 2026
• mastodon Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring CVE-2026-46349 Fix available 5.3 MediumJune 24, 2026
• mastodon Mastodon: SSRF Bypass via IPv6 Unspecified Address (::) CVE-2026-46348 Fix available 8.7 HighJune 24, 2026
• mastodon Mastodon has a consent-check bypass in its remote Collections CVE-2026-47777 Public exploitFix available 7.5 HighJune 15, 2026
• joinmastodon mastodon Mastodon: Insufficient verification of email addresses CVE-2026-41259 Fix available 8.2 HighApril 23, 2026
• joinmastodon mastodon Mastodon has a denial of service for quote authorization CVE-2026-33869 Fix available 4.8 MediumMarch 27, 2026
• joinmastodon mastodon Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>' CVE-2026-33868 Fix available 4.3 MediumMarch 27, 2026
• joinmastodon mastodon Mastodon has SSRF via unvalidated FASP Provider base_url CVE-2026-27477 Fix available 4.6 MediumFebruary 24, 2026
• joinmastodon mastodon Mastodon may allow unconfirmed FASP to make subscriptions CVE-2026-27468 Fix available 4.8 MediumFebruary 24, 2026
• joinmastodon mastodon Mastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via `Rails.cache`) CVE-2026-25540 Fix available 6.5 MediumFebruary 4, 2026
• joinmastodon mastodon Mastodon has insufficient access control to push notification settings CVE-2026-23964 Fix available 6.5 MediumJanuary 22, 2026
• joinmastodon mastodon Mastodon missing length limits on list names, filter names, and filter keywords CVE-2026-23963 Fix available 4.3 MediumJanuary 22, 2026
• joinmastodon mastodon Mastodon vulnerable to Denial of Service from a single post (client/server) CVE-2026-23962 Fix available 7.5 HighJanuary 22, 2026
• joinmastodon mastodon Mastodon may allow a remote suspension bypass CVE-2026-23961 Fix available 5.3 MediumJanuary 22, 2026
• joinmastodon mastodon Local Mastodon users can enumerate and access severed relationships of every other local user CVE-2026-22246 Fix available 6.5 MediumJanuary 8, 2026
• joinmastodon mastodon Mastodon has SSRF Protection bypass CVE-2026-22245 Fix available 7.1 HighJanuary 8, 2026
• joinmastodon mastodon Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration CVE-2025-67500 Fix available 3.7 LowDecember 9, 2025
• joinmastodon mastodon Mastodon quotes control can be bypassed CVE-2025-62605 Fix available 4.3 MediumOctober 21, 2025
• joinmastodon mastodon Mastadon streaming server allows OAuth clients without the `read` scope to subscribe to public channels CVE-2025-62176 Fix available 4.3 MediumOctober 13, 2025
• joinmastodon mastodon Mastodon streaming API fails to disconnect disabled and suspended users CVE-2025-62175 Fix available 4.3 MediumOctober 13, 2025
• joinmastodon mastodon Mastodon allows continued access after password reset via CLI CVE-2025-62174 Fix available 3.5 LowOctober 13, 2025
• joinmastodon mastodon Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails CVE-2025-54879 Fix available 5.3 MediumAugust 5, 2025
• joinmastodon mastodon Mastodon's domain blocks & rationales ignore user approval when visibility set as "users" CVE-2025-27399 Fix available 5.3 MediumFebruary 27, 2025
• joinmastodon mastodon Mastodon's rate-limits are missing on `/auth/setup` CVE-2025-27157 Fix available 5.3 MediumFebruary 27, 2025
• joinmastodon mastodon Mastodon has improper authorship check on audience extension for existing posts CVE-2024-37903 Fix available 8.2 HighJuly 5, 2024
• joinmastodon mastodon Lack of media type verification of Activity Streams objects allows impersonation of remote accounts CVE-2024-25623 Fix available 8.5 HighFebruary 19, 2024
• joinmastodon mastodon Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodon CVE-2024-25619 Fix available 3.1 LowFebruary 14, 2024
• joinmastodon mastodon External OpenID Connect Account Takeover by E-Mail Change in mastodon CVE-2024-25618 Fix available 4.2 MediumFebruary 14, 2024
• joinmastodon mastodon Mastodon Remote user impersonation and takeover CVE-2024-23832 Fix available 9.4 CriticalFebruary 1, 2024
• joinmastodon mastodon Mastodon vulnerable to Stored XSS through the translation feature CVE-2023-42452 Fix available 6.1 MediumSeptember 19, 2023
• joinmastodon mastodon Mastodon Invalid Domain Name Normalization vulnerability CVE-2023-42451 Fix available 7.4 HighSeptember 19, 2023
• joinmastodon mastodon Mastodon Server-Side Request Forgery vulnerability CVE-2023-42450 Fix available 5.4 MediumSeptember 19, 2023
• joinmastodon mastodon Mastodon's verified profile links can be formatted in a misleading way CVE-2023-36462 Fix available 5.4 MediumJuly 6, 2023
• joinmastodon mastodon Mastodon vulnerable to Denial of Service through slow HTTP responses CVE-2023-36461 Fix available 7.5 HighJuly 6, 2023
• joinmastodon mastodon Mastodon vulnerable to arbitrary file creation through media attachments CVE-2023-36460 Fix available EPSS 40.1% 10.0 CriticalJuly 6, 2023
• joinmastodon mastodon Mastodon vulnerable to Cross-site Scripting through oEmbed preview cards CVE-2023-36459 Fix available 9.3 CriticalJuly 6, 2023
• joinmastodon mastodon Mastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP database CVE-2023-28853 Fix available 7.7 HighApril 4, 2023
• joinmastodon mastodon, mastodon mastodon/mastodon +1 more Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon CVE-2022-2166 Fix available 9.8 CriticalNovember 16, 2022
• joinmastodon mastodon, mastodon mastodon/mastodon +1 more Prototype Pollution in mastodon/mastodon CVE-2022-0432 Fix available 7.4 HighFebruary 2, 2022