SB2026090719 - Multiple vulnerabilities in Mastodon

Description

This security bulletin contains information about 2 vulnerabilities.

1) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to restore their ability to log in.

The vulnerability exists due to incomplete permission checks in the admin API when handling requests from staff accounts disabled through the Freeze action. A remote privileged user can invoke admin API endpoints to restore their ability to log in.

The issue is specific to accounts disabled through the Freeze action; accounts demoted from their roles or suspended lose API access.

2) Improper Authentication (CVE-ID: N/A)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to log in to affected accounts without a valid password.

The vulnerability exists due to improper authentication in Mastodon\'s authentication flow when processing sign-in attempts for accounts without database-stored passwords. A remote attacker can provide any password and proceed to second-factor authentication to log in to affected accounts without a valid password.

Exploitation requires a valid security key, backup code, or TOTP token for an account with two-factor authentication enabled that uses LDAP, PAM, or server-configured SSO.

Remediation

Install update from vendor's website.

References

• https://github.com/mastodon/mastodon/security/advisories/GHSA-62j4-hvj7-px3f
• https://github.com/mastodon/mastodon/security/advisories/GHSA-vx32-x96w-qq65