CVE-2025-27399

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-27399
Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/reasons is set to "users" (localized English string: "To logged-in users"), users that are not yet approved can view the block reasons. Instance admins that do not want their domain blocks to be public are impacted. Versions 4.1.23, 4.2.16, and 4.3.4 fix the issue.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/mastodon/mastodon/blob/93f0427b8a84faf68d5d02cdf9a26f98fae16f2b/app/controllers/api/v1/instances/domain_blocks_controller.rb#L33-L35 Product
https://github.com/mastodon/mastodon/blob/93f0427b8a84faf68d5d02cdf9a26f98fae16f2b/app/controllers/api/v1/instances/domain_blocks_controller.rb#L49-L51 Product
https://github.com/mastodon/mastodon/commit/6b519cfefa93a923b19d0f20c292c7185f8fd5f5 Patch
https://github.com/mastodon/mastodon/security/advisories/GHSA-94h4-fj37-c825 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*
cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*
cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*
History

24 Jun 2025, 15:59

Type Values Removed Values Added
References () https://github.com/mastodon/mastodon/blob/93f0427b8a84faf68d5d02cdf9a26f98fae16f2b/app/controllers/api/v1/instances/domain_blocks_controller.rb#L33-L35 - () https://github.com/mastodon/mastodon/blob/93f0427b8a84faf68d5d02cdf9a26f98fae16f2b/app/controllers/api/v1/instances/domain_blocks_controller.rb#L33-L35 - Product
References () https://github.com/mastodon/mastodon/blob/93f0427b8a84faf68d5d02cdf9a26f98fae16f2b/app/controllers/api/v1/instances/domain_blocks_controller.rb#L49-L51 - () https://github.com/mastodon/mastodon/blob/93f0427b8a84faf68d5d02cdf9a26f98fae16f2b/app/controllers/api/v1/instances/domain_blocks_controller.rb#L49-L51 - Product
References () https://github.com/mastodon/mastodon/commit/6b519cfefa93a923b19d0f20c292c7185f8fd5f5 - () https://github.com/mastodon/mastodon/commit/6b519cfefa93a923b19d0f20c292c7185f8fd5f5 - Patch
References () https://github.com/mastodon/mastodon/security/advisories/GHSA-94h4-fj37-c825 - () https://github.com/mastodon/mastodon/security/advisories/GHSA-94h4-fj37-c825 - Vendor Advisory
First Time Joinmastodon mastodon
Joinmastodon
CPE cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*
Summary
  • (es) Mastodon es una plataforma de microblogging federada y alojada por el usuario. En versiones anteriores a 4.1.23, 4.2.16 y 4.3.4, cuando la visibilidad de los bloqueos/razones de dominio está configurada en "usuarios" (cadena localizada en inglés: "To logged-in users"), los usuarios que aún no hayan sido aprobados pueden ver los motivos de bloqueo. Los administradores de instancias que no desean que sus bloqueos de dominio sean públicos se ven afectados. Las versiones 4.1.23, 4.2.16 y 4.3.4 solucionan el problema.

27 Feb 2025, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-27 18:15

Updated : 2025-06-24 15:59

NVD link : CVE-2025-27399

Mitre link : CVE-2025-27399

CVE.ORG link : CVE-2025-27399

JSON object : View

Products Affected

joinmastodon

  • mastodon
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-285

Improper Authorization