Joinmastodon vulnerabilities
We track 3 vulnerabilities in Joinmastodon products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on July 5, 2024.
Latest Joinmastodon vulnerabilities
- 8.2 High severity
mastodon: Missing Authorization
Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting specific activities, an attacker can extend the audience of a post they do not own to other Mastodon users on a target s
- 7.5 High severity
Mastodon: Uncontrolled Recursion
Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacker-controlled accounts on certain other servers associated with a wildcard DNS A record, such that there is uncontrolled
- 9.8 Critical severity
Mastodon: Incorrect Authorization
Mastodon before 3.3.2 and 3.4.x before 3.4.6 has incorrect access control because it does not compact incoming signed JSON-LD activities. (JSON-LD signing has been supported since version 1.6.0.)