UpHeron
All vulnerabilities

Servers and applications

CVE-2025-62176

Streaming server allows OAuth clients without the `read` scope to subscribe to public channels

Severity
Medium 4.3
Published
13 Oct 2025
Last changed
19 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
4.2.27, 4.3.14, 4.4.6
Also known as
GHSA-7gwh-mw97-qjgp
Sources
NVD, Project advisories (GitHub)

Description

Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, the streaming server accepts serving events for public timelines to clients using any valid authentication token, even if those tokens lack the read:statuses scope. This allows OAuth clients without the read scope to subscribe to public channels and receive public timeline…

Affected software

SoftwareAffected versions
MastodonServers and applications · cpe:a:joinmastodon:mastodon
  • Every version before 4.2.27
  • From 4.3.0 before 4.3.14
  • From 4.4.0 before 4.4.6
MastodonServers and applications · github:mastodon/mastodon
  • Every version before 4.2.27

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-62176
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-62176
  • GitHub Advisory Database https://github.com/advisories/GHSA-7gwh-mw97-qjgp
  • github.com https://github.com/mastodon/mastodon/security/advisories/GHSA-7gwh-mw97-qjgp