Vulnerabilities

TI-2026-29867 CVE-2026-41259

Mastodon: Insufficient verification of email addresses

MEDIUM 41

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00213 Published 2026-04-23 Fixed in 4.3.22, 4.4.16 +1 CWE-841

TI-2026-26230 CVE-2026-33869

Mastodon has a denial of service for quote authorization

LOW 21

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00172 Published 2026-03-27 Fixed in 4.5.8, 4.4.15 CWE-863

TI-2026-26229 CVE-2026-33868

Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>'

LOW 28

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00473 Published 2026-03-27 Fixed in 4.5.8, 4.4.15 +1 CWE-601

TI-2026-21884 CVE-2026-27477

Mastodon has SSRF via unvalidated FASP Provider base_url

LOW 21

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 4.0MEDIUM 4.6 Network No auth No interaction EPSS 0.0031 Published 2026-02-24 Fixed in 4.4.14, 4.5.7 CWE-918

TI-2026-21875 CVE-2026-27468

Mastodon may allow unconfirmed FASP to make subscriptions

LOW 22

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 4.0MEDIUM 4.8 Network No auth No interaction EPSS 0.00299 Published 2026-02-24 Fixed in 4.4.14, 4.5.7 CWE-862

TI-2026-20649 CVE-2026-25540

Mastodon's signature-dependent ActivityPub collection responses cached under…

LOW 35

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00437 Published 2026-02-04 Fixed in 4.3.19, 4.4.13 +1 CWE-524

TI-2026-19306 CVE-2026-23964

Mastodon has insufficient access control to push notification settings

LOW 34

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00234 Published 2026-01-22 Fixed in 4.3.18, 4.4.12 +1 CWE-863

TI-2026-19305 CVE-2026-23963

Mastodon missing length limits on list names, filter names, and filter keywords

LOW 29

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00352 Published 2026-01-22 Fixed in 4.3.18, 4.4.12 +1 CWE-770

TI-2026-19304 CVE-2026-23962

Mastodon vulnerable to Denial of Service from a single post (client/server)

MEDIUM 40

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00545 Published 2026-01-22 Fixed in 4.3.18, 4.4.12 +1 CWE-770

TI-2026-19303 CVE-2026-23961

Mastodon may allow a remote suspension bypass

LOW 30

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0044 Published 2026-01-22 Fixed in 4.3.18, 4.4.12 +1 CWE-863

TI-2026-17856 CVE-2026-22246

Local Mastodon users can enumerate and access severed relationships of every other local user

LOW 28

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00268 Published 2026-01-08 Fixed in 4.3.17, 4.4.11 +1 CWE-201

TI-2026-17855 CVE-2026-22245

Mastodon has SSRF Protection bypass

LOW 31

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00289 Published 2026-01-08 Fixed in 4.2.29, 4.3.17 +2 CWE-918

TI-2025-41257 CVE-2025-67500

Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration

LOW 17

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00224 Published 2025-12-09 Fixed in 4.2.28, 4.3.15 +2 CWE-204

TI-2025-38820 CVE-2025-62605

Mastodon quotes control can be bypassed

LOW 20

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00286 Published 2025-10-21 Fixed in 4.4.8 CWE-754

TI-2025-38494 CVE-2025-62176

Mastadon streaming server allows OAuth clients without the `read` scope to subscribe to public channels

LOW 20

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00275 Published 2025-10-13 Fixed in 4.4.6, 4.3.14 +1 CWE-280

TI-2025-38493 CVE-2025-62175

Mastodon streaming API fails to disconnect disabled and suspended users

LOW 20

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00235 Published 2025-10-13 Fixed in 4.4.6, 4.3.14 +1 CWE-273

TI-2025-38492 CVE-2025-62174

Mastodon allows continued access after password reset via CLI

LOW 16

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00218 Published 2025-10-13 Fixed in 4.4.6, 4.3.14 +1 CWE-613

TI-2025-34613 CVE-2025-54879

Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails

HIGH 72

Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00613 Published 2025-08-05 Fixed in 4.2.24, 4.3.11 +1 CWE-770

TI-2025-20234 CVE-2025-27399

Mastodon's domain blocks & rationales ignore user approval when visibility set as "users"

LOW 30

Mastodon is a self-hosted, federated microblogging platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00357 Published 2025-02-27 Fixed in 4.1.23, 4.2.16 +1 CWE-200

TI-2025-20014 CVE-2025-27157

Mastodon's rate-limits are missing on `/auth/setup`

LOW 30

Mastodon is a self-hosted, federated microblogging platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00369 Published 2025-02-27 Fixed in 4.2.16, 4.3.4 CWE-770

TI-2023-27313 CVE-2023-49952

Mastodon 4.1.x before 4.1.17 and 4.2.x before 4.2.9 allows a bypass of rate limiting via a crafted HTTP request header.

LOW 39

Mastodon 4.1.x before 4.1.17 and 4.2.x before 4.2.9 allows a bypass of rate limiting via a crafted HTTP request header.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0047 Published 2024-11-18 No fix listed CWE-79

TI-2024-22840 CVE-2024-34535 · GHSA-f9c2-396j-6x9r

In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header.

LOW 27

In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header.

CVSS 3.1MEDIUM 5.9 Network Low privileges No interaction EPSS 0.00376 Published 2024-10-03 No fix listed CWE-444

TI-2024-25219 CVE-2024-37903

Mastodon has improper authorship check on audience extension for existing posts

MEDIUM 42

Mastodon is a self-hosted, federated microblogging platform.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.0053 Published 2024-07-05 Fixed in 4.1.18, 4.2.10 CWE-862

TI-2024-16851 CVE-2024-25623

Lack of media type verification of Activity Streams objects allows impersonation of remote accounts

LOW 37

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00511 Published 2024-02-19 Fixed in 3.5.19, 4.0.15 +2 CWE-434

TI-2024-16847 CVE-2024-25619

Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodon

LOW 20

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00363 Published 2024-02-14 Fixed in 4.2.6, 4.1.14 +2 CWE-613

Vulnerabilities

Filters