PT-2025-41808 · Mastodon · Mastodon

Thisismissem · Published 2025-10-13 · Updated 2025-10-20 · CVE-2025-62175

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.4.6 Mastodon versions prior to 4.3.14 Mastodon versions prior to 4.2.27

Description Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.4.6, 4.3.14, and 4.2.27, disabling or suspending a user account does not disconnect the account from the streaming API. This allows disabled or suspended accounts to continue receiving real-time updates through existing streaming connections and to establish new streaming connections, despite being unable to interact with other API endpoints. This behavior undermines moderation actions, as administrators expect disabled or suspended accounts to be fully disconnected from the service.

Recommendations Update Mastodon to version 4.4.6 or later. Update Mastodon to version 4.3.14 or later. Update Mastodon to version 4.2.27 or later.

Exploit

Fix

Weakness Enumeration

CWE-273

CWE-274

Related Identifiers

BIT-MASTODON-2025-62175

CVE-2025-62175

GHSA-R2FH-JR9C-9PXH

Affected Products

Mastodon

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62175.json · Exploit
• https://github.com/mastodon/mastodon/commit/2971ac9863b91372e68ac152caf6f4dbff511d17 · Patch
• https://github.com/mastodon/mastodon/security/advisories/GHSA-r2fh-jr9c-9pxh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62175 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62175 · Security Note
• https://osv.dev/vulnerability/BIT-mastodon-2025-62175 · Vendor Advisory
• https://twitter.com/CVEnew/status/1977848651146768693 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1977867164485890269 · Twitter Post
• https://t.me/cveNotify/139458 · Telegram Post