CVE-2025-27399

Published: Feb 27, 2025Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/reasons is set to "users" (localized English string: "To logged-in users"), users that are not yet approved can view the block reasons. Instance admins that do not want their domain blocks to be public are impacted. Versions 4.1.23, 4.2.16, and 4.3.4 fix the issue.

Affected (3)

Products: Joinmastodon: Mastodon

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Joinmastodon Mastodon	Before 4.1.23
Joinmastodon Mastodon	From 4.2.0 to 4.2.16
Joinmastodon Mastodon	From 4.3.0 to 4.3.4

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

References (4)

https://github.com/mastodon/mastodon/blob/93f0427b8a84faf68d5d02cdf9a26f98fae16f2b/app/controllers/api/v1/instances/domain_blocks_controller.rb#L33-L35

Source: security-advisories@github.com

Product

https://github.com/mastodon/mastodon/blob/93f0427b8a84faf68d5d02cdf9a26f98fae16f2b/app/controllers/api/v1/instances/domain_blocks_controller.rb#L49-L51

Source: security-advisories@github.com

Product

https://github.com/mastodon/mastodon/commit/6b519cfefa93a923b19d0f20c292c7185f8fd5f5

Source: security-advisories@github.com

Patch

https://github.com/mastodon/mastodon/security/advisories/GHSA-94h4-fj37-c825

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.