CVE-2025-27399: Mastodon's domain blocks & rationales ignore user approval when visibility set as "users"
First published: Thu Feb 27 2025(Updated: )
Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/reasons is set to "users" (localized English string: "To logged-in users"), users that are not yet approved can view the block reasons. Instance admins that do not want their domain blocks to be public are impacted. Versions 4.1.23, 4.2.16, and 4.3.4 fix the issue.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mastodon | <4.1.23<4.2.16<4.3.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/mastodon/mastodon/security/advisories/GHSA-94h4-fj37-c825
- https://github.com/mastodon/mastodon/commit/6b519cfefa93a923b19d0f20c292c7185f8fd5f5
- https://github.com/mastodon/mastodon/blob/93f0427b8a84faf68d5d02cdf9a26f98fae16f2b/app/controllers/api/v1/instances/domain_blocks_controller.rb#L33-L35
- https://github.com/mastodon/mastodon/blob/93f0427b8a84faf68d5d02cdf9a26f98fae16f2b/app/controllers/api/v1/instances/domain_blocks_controller.rb#L49-L51
Frequently Asked Questions
What is the severity of CVE-2025-27399?
CVE-2025-27399 is considered a medium severity vulnerability due to unauthorized access to block reasons by unapproved users.
How do I fix CVE-2025-27399?
To fix CVE-2025-27399, update your Mastodon installation to versions 4.1.23, 4.2.16, or 4.3.4 or later.
What are the affected versions for CVE-2025-27399?
CVE-2025-27399 affects Mastodon versions prior to 4.1.23, 4.2.16, and 4.3.4.
What is the impact of CVE-2025-27399 on users?
The impact of CVE-2025-27399 allows unapproved users to see domain block reasons, which may expose sensitive information.
Is there a workaround for CVE-2025-27399 if I cannot update?
There is no specific workaround for CVE-2025-27399, so updating to a patched version is strongly recommended.
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/first-publish-date
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/title
- agent/references
- agent/author
- agent/source
- agent/type
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- vendor/mastodon
- canonical/mastodon