Medium severity4.3NVD Advisory· Published Mar 6, 2023· Updated Jun 17, 2026

CVE-2022-48364

Description

The undo_mark_statuses_as_sensitive method in app/services/approve_appeal_service.rb in Mastodon 3.5.x before 3.5.3 does not use the server's representative account, resulting in moderator identity disclosure when a moderator approves the appeal of a user whose status update was marked as sensitive.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Mastodon/Mastodon3 versions
cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*range: >=3.5.0,<3.5.3
- (no CPE)
- (no CPE)range: <3.5.3
osv-coords
pkg:bitnami/mastodon
Range: >= 3.5.0, < 3.5.3

Patches

Vulnerability mechanics

References

github.com/mastodon/mastodon/compare/v3.5.2...v3.5.3nvdPatchProduct
github.com/mastodon/mastodon/pull/18525nvdPatch
github.com/40826d/advisories/blob/master/CVE-2022-48364/README.mdnvdExploitThird Party Advisory
github.com/mastodon/mastodon/blob/main/CHANGELOG.mdnvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000