UpHeron
All vulnerabilities

Servers and applications

CVE-2025-27399

Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/reasons is set to "users" (localized English string: "To logged-in users"), users that are not yet approved can view the block reasons. Instance admins that do not want their domain blocks to be public are impacted. Versions 4.1.23, 4.2.16, and 4.3.4…

Severity
Medium 5.3
Published
27 Feb 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
4.1.23, 4.2.16, 4.3.4
Sources
NVD

Affected software

SoftwareAffected versions
MastodonServers and applications · cpe:a:joinmastodon:mastodon
  • Every version before 4.1.23
  • From 4.2.0 before 4.2.16
  • From 4.3.0 before 4.3.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-27399
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-27399