Mastodon up to 4.2.26/4.3.13/4.4.5 insufficient permissions or privileges

Summaryinfo

A vulnerability has been found in Mastodon up to 4.2.26/4.3.13/4.4.5 and classified as problematic. This affects an unknown function. Performing a manipulation results in insufficient permissions or privileges. This vulnerability is cataloged as CVE-2025-62176. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic has been found in Mastodon up to 4.2.26/4.3.13/4.4.5. This affects an unknown part. The manipulation with an unknown input leads to a insufficient permissions or privileges vulnerability. CWE is classifying the issue as CWE-280. The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. This is going to have an impact on confidentiality. The summary by CVE is:

Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, the streaming server accepts serving events for public timelines to clients using any valid authentication token, even if those tokens lack the read:statuses scope. This allows OAuth clients without the read scope to subscribe to public channels and receive public timeline events. The impact is limited, as this only affects new public posts published on the public timelines and requires an otherwise valid token, but this may lead to unexpected access to public posts in a limited-federation setting. This issue has been patched in versions 4.4.6, 4.3.14, and 4.2.27. No known workarounds exist.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2025-62176 since 10/07/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1222 for this issue.

Upgrading to version 4.2.27, 4.3.14 or 4.4.6 eliminates this vulnerability. Applying the patch 7e98fa9b476fdaed235519f1d527eb956004ba0c is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Mastodon

Version

• 4.2.0
• 4.2.1
• 4.2.2
• 4.2.3
• 4.2.4
• 4.2.5
• 4.2.6
• 4.2.7
• 4.2.8
• 4.2.9
• 4.2.10
• 4.2.11
• 4.2.12
• 4.2.13
• 4.2.14
• 4.2.15
• 4.2.16
• 4.2.17
• 4.2.18
• 4.2.19
• 4.2.20
• 4.2.21
• 4.2.22
• 4.2.23
• 4.2.24
• 4.2.25
• 4.2.26
• 4.3.0
• 4.3.1
• 4.3.2
• 4.3.3
• 4.3.4
• 4.3.5
• 4.3.6
• 4.3.7
• 4.3.8
• 4.3.9
• 4.3.10
• 4.3.11
• 4.3.12
• 4.3.13
• 4.4.0
• 4.4.1
• 4.4.2
• 4.4.3
• 4.4.4
• 4.4.5

License

• open-source

Website

• Product: https://github.com/mastodon/mastodon/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion