CVE-2025-27399CWE-200CWE-285

Mastodon's domain blocks & rationales ignore user approval when visibility set as "users"

Medium · published February 27, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
28.2
In the wild
Unconfirmed
What it is

Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/reasons is set to "users" (localized English string: "To logged-in users"), users that are not yet approved can view the block reasons. Instance admins that do not want their domain blocks to be public are impacted. Versions 4.1.23, 4.2.16, and 4.3.4 fix the issue.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00357 · 28.2th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-285 · Improper Authorization
Published
2025-02-27T17:15Z
EPSS history
Timeline
  • 27 FEB 17:15Z
    Mastodon's domain blocks & rationales ignore user approval when visibility set as "users"
    cvelistv5