CVEvulnerability

CVE-2025-27399

5.3 MEDIUM Published 2025-02-27 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-02-27
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-285

Description

Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/reasons is set to "users" (localized English string: "To logged-in users"), users that are not yet approved can view the block reasons. Instance admins that do not want their domain blocks to be public are impacted. Versions 4.1.23, 4.2.16, and 4.3.4 fix the issue.

Affected configurations

• joinmastodon mastodon (< 4.1.23) • joinmastodon mastodon (>= 4.2.0 < 4.2.16) • joinmastodon mastodon (>= 4.3.0 < 4.3.4)

Related

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-285 Improper Authorization weakness

References