PT-2026-6319 · Mastodon+1 · Mastodon+1

Odgrso · Published 2026-02-04 · Updated 2026-02-06 · CVE-2026-25540

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.3.19 Mastodon versions prior to 4.4.13 Mastodon versions prior to 4.5.6

Description Mastodon, a free, open-source social network server based on ActivityPub, contains a flaw related to web cache poisoning. When the AUTHORIZED FETCH setting is enabled, ActivityPub endpoints for pinned posts and featured hashtags rely on the account that signed the HTTP request. However, the system stores and reuses this content in an internal cache without considering the signing actor. This can lead to a scenario where content intended for legitimate users is served to blocked users, or vice versa, potentially exposing sensitive information or altering the user experience. The issue stems from improper handling of cached responses based on the requesting account. The vulnerable component is Rails.cache.

Recommendations Update Mastodon to version 4.3.19 or later. Update Mastodon to version 4.4.13 or later. Update Mastodon to version 4.5.6 or later.

Exploit

Fix

Weakness Enumeration

CWE-524

Related Identifiers

BIT-MASTODON-2026-25540

CVE-2026-25540

GHSA-CCPR-M53R-MFWR

Affected Products

Mastodon

Rails.Cache

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25540.json · Exploit
• https://github.com/mastodon/mastodon/security/advisories/GHSA-ccpr-m53r-mfwr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25540 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25540 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mastodon-2026-25540 · Vendor Advisory
• https://twitter.com/CVEnew/status/2019182746896355740 · Twitter Post