What’s Vulnerable › Products

mastodon vulnerabilities

53 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 32 published in the last 12 months.

Check whether your mastodon version is affected

Latest mastodon vulnerabilities

• CVE-2026-59825 — Mastodon: Unwanted deactivation of SSL/TLS certificate verification (CVSS 7.4)
• CVE-2026-72916 — Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses (CVSS 6.3)
• CVE-2026-72915 — Mastodon: Personally-identifying information disclosure due to incorrect access control validation (CVSS 7.5)
• CVE-2026-72914 — Mastodon: Exhausting data by an unauthenticated request to the admin retention API (CVSS 7.5)
• CVE-2026-50129 — Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH_TRANSFORMER (CVSS 7.5)
• CVE-2026-50128 — Mastodon: Spoofing of attribution domains (CVSS 5.3)
• CVE-2026-48028 — Mastodon: Removal of integrity-protected JSON entries from signed activities (CVSS 6.5)
• CVE-2026-47389 — Mastodon: SSRF protection bypass on older Ruby versions (CVSS 8.6)
• CVE-2026-46349 — Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring (CVSS 5.3)
• CVE-2026-46348 — Mastodon: SSRF Bypass via IPv6 Unspecified Address (::) (CVSS 8.7)
• CVE-2026-47777 — Mastodon has a consent-check bypass in its remote Collections (CVSS 7.5)
• CVE-2026-41259 — Mastodon: Insufficient verification of email addresses (CVSS 7.5)
• CVE-2026-33869 — Mastodon has a denial of service for quote authorization (CVSS 4.8)
• CVE-2026-33868 — Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>' (CVSS 6.1)
• CVE-2026-27477 — Mastodon has SSRF via unvalidated FASP Provider base_url (CVSS 5.9)
• CVE-2026-27468 — Mastodon may allow unconfirmed FASP to make subscriptions (CVSS 8.2)
• CVE-2026-25540 — Mastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via `Rails.cache`) (CVSS 6.5)
• CVE-2026-23964 — Mastodon has insufficient access control to push notification settings (CVSS 5.4)
• CVE-2026-23963 — Mastodon missing length limits on list names, filter names, and filter keywords (CVSS 6.5)
• CVE-2026-23962 — Mastodon vulnerable to Denial of Service from a single post (client/server) (CVSS 7.5)
• CVE-2026-23961 — Mastodon may allow a remote suspension bypass (CVSS 5.3)
• CVE-2026-22246 — Local Mastodon users can enumerate and access severed relationships of every other local user (CVSS 4.3)
• CVE-2026-22245 — Mastodon has SSRF Protection bypass (CVSS 7.5)
• CVE-2025-67500 — Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration (CVSS 3.7)
• CVE-2025-62605 — Mastodon quotes control can be bypassed (CVSS 4.3)