UpHeron
All vulnerabilities

Servers and applications

CVE-2025-67500

Inconsistent error handling allows anonymously checking existence of known private posts

Severity
Low 3.7
Published
8 Dec 2025
Last changed
14 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
4.2.28, 4.3.15, 4.4.10, 4.5.3
Also known as
GHSA-gwhw-gcjx-72v8
Sources
NVD, Project advisories (GitHub)

Description

Mastodon is a free, open-source social network server based on ActivityPub. Versions 4.2.27 and prior, 4.3.0-beta.1 through 4.3.14, 4.4.0-beta.1 through 4.4.9, 4.5.0-beta.1 through 4.5.2 have discrepancies in error handling which allow checking whether a given status exists by sending a request with a non-English Accept-Language header. Using this behavior, an attacker who knows the identifier…

Affected software

SoftwareAffected versions
MastodonServers and applications · cpe:a:joinmastodon:mastodon
  • Every version before 4.2.28
  • From 4.3.0 before 4.3.15
  • From 4.4.0 before 4.4.10
  • From 4.5.0 before 4.5.3
MastodonServers and applications · github:mastodon/mastodon
  • Every version before 4.2.28

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-67500
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-67500
  • GitHub Advisory Database https://github.com/advisories/GHSA-gwhw-gcjx-72v8
  • github.com https://github.com/mastodon/mastodon/security/advisories/GHSA-gwhw-gcjx-72v8