Vulnerabilities

TI-2026-42641 CVE-2026-59825

Mastodon: Unwanted deactivation of SSL/TLS certificate verification

LOW 35

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00373 Published 2026-08-18 Fixed in 4.4.19, 4.5.12 CWE-295

TI-2026-51132 CVE-2026-72916

Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses

LOW 30

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00974 Published 2026-08-10 Fixed in 4.4.21, 4.5.14 +1 CWE-1286

TI-2026-51131 CVE-2026-72915

Mastodon: Personally-identifying information disclosure due to incorrect access control validation

LOW 39

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00483 Published 2026-08-10 Fixed in 4.6.4 CWE-200

TI-2026-51130 CVE-2026-72914

Mastodon: Exhausting data by an unauthenticated request to the admin retention API

MEDIUM 40

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00827 Published 2026-08-10 Fixed in 4.4.21, 4.5.14 +1 CWE-405

TI-2026-36900 CVE-2026-50129

Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH_TRANSFORMER

LOW 39

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0046 Published 2026-06-24 Fixed in 4.5.11, 4.4.18 +1 CWE-248

TI-2026-36899 CVE-2026-50128

Mastodon: Spoofing of attribution domains

LOW 29

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00183 Published 2026-06-24 Fixed in 4.5.11, 4.4.18 CWE-354

TI-2026-35471 CVE-2026-48028

Mastodon: Removal of integrity-protected JSON entries from signed activities

LOW 34

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00176 Published 2026-06-24 Fixed in 4.5.10, 4.4.17 +1 CWE-354

TI-2026-34959 CVE-2026-47389

Mastodon: SSRF protection bypass on older Ruby versions

MEDIUM 43

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00394 Published 2026-06-24 Fixed in 4.5.10 CWE-184

TI-2026-34067 CVE-2026-46349

Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring

LOW 29

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00195 Published 2026-06-24 Fixed in 4.5.10 CWE-347

TI-2026-34066 CVE-2026-46348

Mastodon: SSRF Bypass via IPv6 Unspecified Address (::)

MEDIUM 44

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00406 Published 2026-06-24 Fixed in 4.5.10 CWE-918

TI-2026-35271 CVE-2026-47777

Mastodon has a consent-check bypass in its remote Collections

LOW 38

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00167 Published 2026-06-15 No fix listed CWE-345

TI-2026-29867 CVE-2026-41259

Mastodon: Insufficient verification of email addresses

MEDIUM 41

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00213 Published 2026-04-23 Fixed in 4.3.22, 4.4.16 +1 CWE-841

TI-2026-26230 CVE-2026-33869

Mastodon has a denial of service for quote authorization

LOW 21

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00172 Published 2026-03-27 Fixed in 4.5.8, 4.4.15 CWE-863

TI-2026-26229 CVE-2026-33868

Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>'

LOW 28

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00473 Published 2026-03-27 Fixed in 4.5.8, 4.4.15 +1 CWE-601

TI-2026-21884 CVE-2026-27477

Mastodon has SSRF via unvalidated FASP Provider base_url

LOW 21

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 4.0MEDIUM 4.6 Network No auth No interaction EPSS 0.0031 Published 2026-02-24 Fixed in 4.4.14, 4.5.7 CWE-918

TI-2026-21875 CVE-2026-27468

Mastodon may allow unconfirmed FASP to make subscriptions

LOW 22

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 4.0MEDIUM 4.8 Network No auth No interaction EPSS 0.00299 Published 2026-02-24 Fixed in 4.4.14, 4.5.7 CWE-862

TI-2026-20649 CVE-2026-25540

Mastodon's signature-dependent ActivityPub collection responses cached under…

LOW 35

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00437 Published 2026-02-04 Fixed in 4.3.19, 4.4.13 +1 CWE-524

TI-2026-19306 CVE-2026-23964

Mastodon has insufficient access control to push notification settings

LOW 34

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00234 Published 2026-01-22 Fixed in 4.3.18, 4.4.12 +1 CWE-863

TI-2026-19305 CVE-2026-23963

Mastodon missing length limits on list names, filter names, and filter keywords

LOW 29

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00352 Published 2026-01-22 Fixed in 4.3.18, 4.4.12 +1 CWE-770

TI-2026-19304 CVE-2026-23962

Mastodon vulnerable to Denial of Service from a single post (client/server)

MEDIUM 40

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00545 Published 2026-01-22 Fixed in 4.3.18, 4.4.12 +1 CWE-770

TI-2026-19303 CVE-2026-23961

Mastodon may allow a remote suspension bypass

LOW 30

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0044 Published 2026-01-22 Fixed in 4.3.18, 4.4.12 +1 CWE-863

TI-2026-17856 CVE-2026-22246

Local Mastodon users can enumerate and access severed relationships of every other local user

LOW 28

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00268 Published 2026-01-08 Fixed in 4.3.17, 4.4.11 +1 CWE-201

TI-2026-17855 CVE-2026-22245

Mastodon has SSRF Protection bypass

LOW 31

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00289 Published 2026-01-08 Fixed in 4.2.29, 4.3.17 +2 CWE-918

TI-2025-41257 CVE-2025-67500

Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration

LOW 17

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00224 Published 2025-12-09 Fixed in 4.2.28, 4.3.15 +2 CWE-204

TI-2025-38820 CVE-2025-62605

Mastodon quotes control can be bypassed

LOW 20

Mastodon is a free, open-source social network server based on ActivityPub.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00286 Published 2025-10-21 Fixed in 4.4.8 CWE-754

Vulnerabilities

Filters