CVE-2025-62175
Description
Mastodon is a free, open-source social network server based on ActivityPub. In versions before 4.4.6, 4.3.14, and 4.2.27, disabling or suspending a user account does not disconnect the account from the streaming API. This allows disabled or suspended accounts to continue receiving real-time updates through existing streaming connections and to establish new streaming connections, even though they cannot interact with other API endpoints. This undermines moderation actions, as administrators expect disabled or suspended accounts to be fully disconnected from the service. This issue has been patched in versions 4.4.6, 4.3.14, and 4.2.27. No known workarounds exist.
How to fix
- joinmastodon mastodon4.2.27, 4.3.14, 4.4.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| joinmastodon mastodon | v < 4.2.27, 4.3.0 ≤ v < 4.3.14, 4.4.0 ≤ v < 4.4.6 | 4.2.27, 4.3.14, 4.4.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.