Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/reasons is set to "users" (localized English string: "To logged-in users"), users that are not yet approved can view the block reasons. Instance admins that do not want their domain blocks to be public are impacted. Versions 4.1.23, 4.2.16, and 4.3.4 fix the issue.
CVSS
No CVSS.
References
Configurations
Configuration 1 (hide)
|
History
24 Jun 2025, 15:59
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/mastodon/mastodon/commit/6b519cfefa93a923b19d0f20c292c7185f8fd5f5 - Patch | |
| References | () https://github.com/mastodon/mastodon/security/advisories/GHSA-94h4-fj37-c825 - Vendor Advisory | |
| References | () https://github.com/mastodon/mastodon/blob/93f0427b8a84faf68d5d02cdf9a26f98fae16f2b/app/controllers/api/v1/instances/domain_blocks_controller.rb#L49-L51 - Product | |
| References | () https://github.com/mastodon/mastodon/blob/93f0427b8a84faf68d5d02cdf9a26f98fae16f2b/app/controllers/api/v1/instances/domain_blocks_controller.rb#L33-L35 - Product | |
| CPE | cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:* | |
| First Time |
Joinmastodon mastodon
Joinmastodon |
27 Feb 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-02-27 18:15
Updated : 2025-06-24 15:59
NVD link : CVE-2025-27399
Mitre link : CVE-2025-27399
JSON object : View
Products Affected
joinmastodon
- mastodon