PT-2025-41809 · Mastodon · Mastodon

Thisismissem · Published 2025-10-13 · Updated 2025-10-20 · CVE-2025-62176

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.2.27 Mastodon versions prior to 4.3.14 Mastodon versions prior to 4.4.6

Description Mastodon is a free, open-source social network server based on ActivityPub. The streaming server incorrectly handles authentication tokens, accepting events for public timelines from clients with valid tokens that do not have the required read:statuses scope. This allows OAuth clients lacking the necessary permissions to subscribe to public channels and receive public timeline events. The impact is limited to new public posts and requires a valid token, but may result in unintended access to public posts in limited-federation environments.

Recommendations Update Mastodon to version 4.2.27 or later. Update Mastodon to version 4.3.14 or later. Update Mastodon to version 4.4.6 or later.

Exploit

Fix

Weakness Enumeration

CWE-280

Related Identifiers

BIT-MASTODON-2025-62176

CVE-2025-62176

GHSA-7GWH-MW97-QJGP

Affected Products

Mastodon

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62176.json · Exploit
• https://github.com/mastodon/mastodon/security/advisories/GHSA-7gwh-mw97-qjgp · Vendor Advisory
• https://github.com/mastodon/mastodon/commit/7e98fa9b476fdaed235519f1d527eb956004ba0c · Patch
• https://osv.dev/vulnerability/BIT-mastodon-2025-62176 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62176 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62176 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1977856926051344644 · Twitter Post
• https://twitter.com/CVEnew/status/1977848650123341880 · Twitter Post
• https://t.me/cveNotify/139459 · Telegram Post