Mastodon vulnerabilities
46 CVEs and advisories name Mastodon as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-59825Mastodon: Unwanted deactivation of SSL/TLS certificate verification
- CVE-2026-72916Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses
- CVE-2026-72915Mastodon: Personally-identifying information disclosure due to incorrect access control validation
- CVE-2026-72914Mastodon: Exhausting data by an unauthenticated request to the admin retention API
- CVE-2026-50129Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH_TRANSFORMER
- CVE-2026-50128Mastodon: Spoofing of attribution domains
- CVE-2026-48028Mastodon: Removal of integrity-protected JSON entries from signed activities
- CVE-2026-47389Mastodon: SSRF protection bypass on older Ruby versions
- CVE-2026-46349Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring
- CVE-2026-46348Mastodon: SSRF Bypass via IPv6 Unspecified Address (::)
- CVE-2026-47777Mastodon has a consent-check bypass in its remote Collections
- CVE-2026-41259Mastodon: Insufficient verification of email addresses
- CVE-2026-33869Mastodon has a denial of service for quote authorization
- CVE-2026-33868Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>'
- CVE-2026-27477Mastodon has SSRF via unvalidated FASP Provider base_url
- CVE-2026-27468Mastodon may allow unconfirmed FASP to make subscriptions
- CVE-2026-25540Mastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via `Rails.cache`)
- CVE-2026-23964Mastodon has insufficient access control to push notification settings
- CVE-2026-23963Mastodon missing length limits on list names, filter names, and filter keywords
- CVE-2026-23962Mastodon vulnerable to Denial of Service from a single post (client/server)
- CVE-2026-23961Mastodon may allow a remote suspension bypass
- CVE-2026-22246Local Mastodon users can enumerate and access severed relationships of every other local user
- CVE-2026-22245Mastodon has SSRF Protection bypass
- CVE-2025-67500Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration
- CVE-2025-62605Mastodon quotes control can be bypassed
- CVE-2025-62176Mastadon streaming server allows OAuth clients without the `read` scope to subscribe to public channels
- CVE-2025-62175Mastodon streaming API fails to disconnect disabled and suspended users
- CVE-2025-62174Mastodon allows continued access after password reset via CLI
- CVE-2025-54879Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails
- CVE-2025-27399Mastodon's domain blocks & rationales ignore user approval when visibility set as "users"