Unrated severityNVD Advisory· Published Feb 27, 2025· Updated Feb 27, 2025
Mastodon's domain blocks & rationales ignore user approval when visibility set as "users"
CVE-2025-27399
Description
Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/reasons is set to "users" (localized English string: "To logged-in users"), users that are not yet approved can view the block reasons. Instance admins that do not want their domain blocks to be public are impacted. Versions 4.1.23, 4.2.16, and 4.3.4 fix the issue.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/mastodon/mastodon/blob/93f0427b8a84faf68d5d02cdf9a26f98fae16f2b/app/controllers/api/v1/instances/domain_blocks_controller.rbmitrex_refsource_MISC
- github.com/mastodon/mastodon/blob/93f0427b8a84faf68d5d02cdf9a26f98fae16f2b/app/controllers/api/v1/instances/domain_blocks_controller.rbmitrex_refsource_MISC
- github.com/mastodon/mastodon/commit/6b519cfefa93a923b19d0f20c292c7185f8fd5f5mitrex_refsource_MISC
- github.com/mastodon/mastodon/security/advisories/GHSA-94h4-fj37-c825mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.