CVE-2025-27399 Mastodon's domain blocks & rationales ignore user approval when visibility set as "users"

What is CVE-2025-27399?

CVE-2025-27399 is a medium-severity missing authorization vulnerability in mastodon, published on 27 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/reasons is set to "users" (localized English string: "To logged-in users"), users that are not yet approved can view the block reasons. Instance admins that do not want their domain blocks to be public are impacted. Versions 4.1.23, 4.2.16, and 4.3.4 fix the issue.

Weakness: CWE-285, CWE-200

Which versions are affected by CVE-2025-27399?

1 open source package ship an affected version, including mastodon. It affects 1 product.

Products include Joinmastodon Mastodon.

How do I fix CVE-2025-27399?

Upgrade mastodon to 4.3.4 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-27399 being exploited?

There is no known exploitation of CVE-2025-27399 in the wild and no public exploit code.

Other vulnerabilities in mastodon

• CVE-2023-36460 Mastodon vulnerable to arbitrary file creation through media attachments Critical 10.0
• CVE-2022-2166 Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon Critical 9.8
• CVE-2022-24307 Missing authorization in n/a Critical 9.8
• CVE-2018-21018 Auth bypass in n/a Critical 9.8
• CVE-2024-23832 Mastodon Remote user impersonation and takeover Critical 9.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-mastodon-2025-27399, GHSA-94h4-fj37-c825.