SB20260728108 - Multiple vulnerabilities in Mastodon

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260728108

SB20260728108 - Multiple vulnerabilities in Mastodon

Published: July 28, 2026

Security Bulletin ID SB20260728108
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Improper Validation of Syntactic Correctness of Input (CVE-ID: N/A)

CWE-ID: CWE-1286 - Improper Validation of Syntactic Correctness of Input

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to access otherwise private resources and services.

The vulnerability exists due to improper validation of syntactic correctness of input in SSRF protection for outbound HTTP requests when processing user-provided domains containing IPv4-compatible IPv6 addresses. A remote attacker can supply a crafted address to make Mastodon perform HTTP requests against loopback interfaces to access otherwise private resources and services.

This can only be exploited on systems that support IPv4-compatible IPv6 addresses.


2) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to incorrect access control validation in user collection access controls when handling requests for collection member information. A remote attacker can access personally identifying information of other local users to disclose sensitive information.

The exposed information includes the last used IP address and current email address of another local user that is currently part of a collection.


3) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in statistics endpoints when handling anonymous requests. A remote attacker can issue potentially expensive requests to cause a denial of service.

The affected endpoints check permissions before returning results, but not before computing them, which can trigger expensive long-running SQL queries.


Remediation

Install update from vendor's website.

References