MA
Product
mastodon
28
CVEs
0
On KEV
8.7
Max CVSS
0
New 30D
Severity mix
Critical 0High 11Medium 15Low 2
Watch
Add mastodon to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-46348 | 8.7 | Jun 24 | Mastodon: SSRF Bypass via IPv6 Unspecified Address (::) Affected: >= 4.5.0-beta.1, < 4.5.10 |
| CVE-2026-47389 | 8.6 | Jun 24 | Mastodon: SSRF protection bypass on older Ruby versions Affected: >= 4.5.0-beta.1, < 4.5.10 |
| CVE-2026-27468 | 8.2 | Feb 24 | Mastodon may allow unconfirmed FASP to make subscriptions Affected: >= 4.4.0, < 4.4.14; >= 4.5.0, < 4.5.7 |
| CVE-2026-72915 | 7.5 | Aug 10 | Mastodon: Personally-identifying information disclosure due to incorrect access control validation Affected: >= 4.6.0-beta.1, < 4.6.4 |
| CVE-2026-72914 | 7.5 | Aug 10 | Mastodon: Exhausting data by an unauthenticated request to the admin retention API Affected: < 4.4.21; >= 4.5.0-beta.1, < 4.5.14; >= 4.6.0-beta.1, < 4.6.4 |
| CVE-2026-50129 | 7.5 | Jun 24 | Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH_TRANSFORMER Affected: >= 4.5.0-beta.1, < 4.5.11; >= 4.4.0-beta.1, < 4.4.18; < 4.3.24 |
| CVE-2026-47777 | 7.5 | Jun 15 | Mastodon has a consent-check bypass in its remote Collections Affected: >= nightly.2026-03-10, < 4.6.0-beta.1 |
| CVE-2026-41259 | 7.5 | Apr 23 | Mastodon: Insufficient verification of email addresses Affected: < 4.3.22; >= 4.4.0-beta.1, < 4.4.16; >= 4.5.0-beta.1, < 4.5.9 |
| CVE-2026-23962 | 7.5 | Jan 22 | Mastodon vulnerable to Denial of Service from a single post (client/server) Affected: < 4.3.18; >= 4.4.0, < 4.4.12; >= 4.5.0, < 4.5.5 |
| CVE-2026-22245 | 7.5 | Jan 8 | Mastodon has SSRF Protection bypass Affected: < 4.2.29; >= 4.3.0-beta.1, < 4.3.17; >= 4.4.0-beta.1, < 4.4.11; >= 4.5.0-beta.1, < 4.5.4 |
| CVE-2026-59825 | 7.4 | Aug 18 | Mastodon: Unwanted deactivation of SSL/TLS certificate verification Affected: < 4.4.19; >= 4.5.0, < 4.5.12 |
| CVE-2026-48028 | 6.5 | Jun 24 | Mastodon: Removal of integrity-protected JSON entries from signed activities Affected: >= 4.5.0-beta.1, < 4.5.10; >= 4.4.0-beta.1, < 4.4.17; < 4.3.23 |
| CVE-2026-25540 | 6.5 | Feb 4 | Mastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via `Rails.cache`) Affected: < 4.3.19; < 4.4.13; < 4.5.6 |
| CVE-2026-23963 | 6.5 | Jan 22 | Mastodon missing length limits on list names, filter names, and filter keywords Affected: < 4.3.18; >= 4.4.0, < 4.4.12; >= 4.5.0, < 4.5.5 |
| CVE-2026-72916 | 6.3 | Aug 10 | Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses Affected: < 4.4.21; >= 4.5.0-beta.1, < 4.5.14; >= 4.6.0-beta.1, < 4.6.4 |
| CVE-2026-33868 | 6.1 | Mar 27 | Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>' Affected: >= 4.5.0, < 4.5.8; >= 4.4.0, < 4.4.15; < 4.3.21 |
| CVE-2026-27477 | 5.9 | Feb 24 | Mastodon has SSRF via unvalidated FASP Provider base_url Affected: >= 4.4.0, < 4.4.14; >= 4.5.0, < 4.5.7 |
| CVE-2026-23964 | 5.4 | Jan 22 | Mastodon has insufficient access control to push notification settings Affected: < 4.3.18; >= 4.4.0, < 4.4.12; >= 4.5.0, < 4.5.5 |
| CVE-2026-50128 | 5.3 | Jun 24 | Mastodon: Spoofing of attribution domains Affected: >= 4.5.0-beta.1, < 4.5.11; >= 4.3.0, < 4.4.18 |
| CVE-2026-46349 | 5.3 | Jun 24 | Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring Affected: >= 4.5.0-beta.1, < 4.5.10 |
| CVE-2026-23961 | 5.3 | Jan 22 | Mastodon may allow a remote suspension bypass Affected: < 4.3.18; >= 4.4.0, < 4.4.12; >= 4.5.0, < 4.5.5 |
| CVE-2026-33869 | 4.8 | Mar 27 | Mastodon has a denial of service for quote authorization Affected: >= 4.5.0, < 4.5.8; >= 4.4.0, < 4.4.15 |
| CVE-2026-22246 | 4.3 | Jan 8 | Local Mastodon users can enumerate and access severed relationships of every other local user Affected: < 4.3.17; >= 4.4.0-beta.1, < 4.4.11; >= 4.5.0-beta.1, < 4.5.4 |
| CVE-2025-62605 | 4.3 | Oct 21 | Mastodon quotes control can be bypassed Affected: >= 4.4.0-beta.1, < 4.4.8; = 4.5.0-beta.1 |
| CVE-2025-62176 | 4.3 | Oct 13 | Mastadon streaming server allows OAuth clients without the `read` scope to subscribe to public channels Affected: >= 4.4.0-beta.1, < 4.4.6; >= 4.3.0-beta.1, < 4.3.14; < 4.2.27 |
| CVE-2025-62175 | 4.3 | Oct 13 | Mastodon streaming API fails to disconnect disabled and suspended users Affected: >= 4.4.0-beta.1, < 4.4.6; >= 4.3.0-beta.1, < 4.3.14; < 4.2.27 |
| CVE-2025-67500 | 3.7 | Dec 9 | Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration Affected: < 4.2.28; >= 4.3.0-beta.1, < 4.3.15; >= 4.4.0-beta.1, < 4.4.10; >= 4.5.0-beta.1, < 4.5.3 |
| CVE-2025-62174 | 3.5 | Oct 13 | Mastodon allows continued access after password reset via CLI Affected: >= 4.4.0-beta.1, < 4.4.6; >= 4.3.0-beta.1, < 4.3.14; < 4.2.27 |
Showing 28