CVE-2026-72916 | | | 2026-08-10 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.private_addre… |
CVE-2026-72915 | High | 7.5 | 2026-08-10 | Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use… |
CVE-2026-72914 | High | 7.5 | 2026-08-10 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics end… |
CVE-2026-50129 | High | 7.5 | 2026-06-24 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.11, 4.4.18, and 4.3.24, a DoS can be triggered by (Uncaught Exception… |
CVE-2026-50128 | Medium | 5.3 | 2026-06-24 | Mastodon is a free, open-source social network server based on ActivityPub. From 4.3.0 until 4.5.11 and 4.4.18, Mastodon has a feature to let websites credit a… |
CVE-2026-48028 | Medium | 6.5 | 2026-06-24 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, Mastodon's normalization of incoming activitie… |
CVE-2026-47389 | High | 8.6 | 2026-06-24 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, when using Ruby versions older than 3.4, Priva… |
CVE-2026-46349 | Medium | 5.3 | 2026-06-24 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, Mastodon's normalization of incoming activitie… |
CVE-2026-46348 | | | 2026-06-24 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, the list of disallowed IP address ranges was l… |
CVE-2026-47777 | High | 7.5 | 2026-06-15 | Mastodon is a free, open-source social network server based on ActivityPub. In versions there is a missing condition in the check if remote accounts consented… |
CVE-2026-41259 | High | 7.5 | 2026-04-23 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to v4.5.9, v4.4.16, and v4.3.22, Mastodon allows restricting new user sign-up… |
CVE-2026-33869 | Medium | 4.8 | 2026-03-27 | Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.5.x branch prior to 4.5.8 and on the 4.4.x branch prior to 4.4… |
CVE-2026-33868 | Medium | 4.3 | 2026-03-27 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulne… |
CVE-2026-27477 | Medium | 5.9 | 2026-02-24 | Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versions 4.4.0 t… |
CVE-2026-27468 | High | 8.2 | 2026-02-24 | Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versions 4.4.0 t… |
CVE-2026-25540 | Medium | 6.5 | 2026-02-04 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.3.19, 4.4.13, 4.5.6, Mastodon is vulnerable to web cache poison… |
CVE-2026-23964 | Medium | 6.5 | 2026-01-22 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, an insecure direct object reference in… |
CVE-2026-23963 | Medium | 4.3 | 2026-01-22 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, the server does not enforce a maximum… |
CVE-2026-23962 | High | 7.5 | 2026-01-22 | Mastodon is a free, open-source social network server based on ActivityPub. Mastodon versions before v4.3.18, v4.4.12, and v4.5.5 do not have a limit on the ma… |
CVE-2026-23961 | Medium | 5.3 | 2026-01-22 | Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows server administrators to suspend remote users to prevent interactio… |
CVE-2026-22246 | Medium | 6.5 | 2026-01-08 | Mastodon is a free, open-source social network server based on ActivityPub. Mastodon 4.3 added notifications of severed relationships, allowing end-users to in… |
CVE-2026-22245 | High | 7.5 | 2026-01-08 | Mastodon is a free, open-source social network server based on ActivityPub. By nature, Mastodon performs a lot of outbound requests to user-provided domains. M… |
CVE-2025-67500 | Low | 3.7 | 2025-12-10 | Mastodon is a free, open-source social network server based on ActivityPub. Versions 4.2.27 and prior, 4.3.0-beta.1 through 4.3.14, 4.4.0-beta.1 through 4.4.9… |
CVE-2025-62605 | Medium | 4.3 | 2025-10-21 | Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon version 4.4, support for verifiable quote posts with quote controls was… |
CVE-2025-62176 | Medium | 4.3 | 2025-10-13 | Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, the streaming server accepts serving… |
CVE-2025-62175 | Medium | 4.3 | 2025-10-13 | Mastodon is a free, open-source social network server based on ActivityPub. In versions before 4.4.6, 4.3.14, and 4.2.27, disabling or suspending a user accoun… |
CVE-2025-62174 | Low | 3.5 | 2025-10-13 | Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, when an administrator resets a user… |
CVE-2025-54879 | Medium | 5.3 | 2025-08-06 | Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5… |
CVE-2025-27399 | Medium | 5.3 | 2025-02-27 | Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/reasons is s… |
CVE-2025-27157 | Medium | 5.3 | 2025-02-27 | Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on `… |
CVE-2024-37903 | High | 8.2 | 2024-07-05 | Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting specific activities… |
CVE-2024-25623 | High | 8.5 | 2024-02-19 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19, when fetching remote statuses… |
CVE-2024-25619 | Low | 3.1 | 2024-02-14 | Mastodon is a free, open-source social network server based on ActivityPub. When an OAuth Application is destroyed, the streaming server wasn't being informed… |
CVE-2024-25618 | Medium | 4.2 | 2024-02-14 | Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows new identities from configured authentication providers (CAS, SAML… |
CVE-2024-23832 | Critical | 9.4 | 2024-02-01 | Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin… |
CVE-2023-42452 | Medium | 6.1 | 2023-09-19 | Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.x branch prior to versions 4.0.10, 4.2.8, and 4.2.0-rc2, under… |
CVE-2023-42451 | High | 7.4 | 2023-09-19 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances… |
CVE-2023-42450 | Medium | 5.4 | 2023-09-19 | Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specifi… |
CVE-2023-36462 | Medium | 5.4 | 2023-07-06 | Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacke… |
CVE-2023-36461 | High | 7.5 | 2023-07-06 | Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read o… |
CVE-2023-36460 | Critical | 9.9 | 2023-07-06 | Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 3.5.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, attackers… |
CVE-2023-36459 | Critical | 9.3 | 2023-07-06 | Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker… |
CVE-2023-28853 | High | 7.7 | 2023-04-04 | Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Starting in version 2.5.0… |
CVE-2022-2166 | Critical | 9.8 | 2022-11-16 | Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0. |
CVE-2022-0432 | Medium | 6.1 | 2022-02-02 | Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0. |