CVE-2026-25540 Information disclosure in mastodon
Attackers can poison the cache to serve incorrect ActivityPub content, leaking data to blocked users or hiding it from legitimate ones.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25540?
CVE-2026-25540 is a medium-severity vulnerability in mastodon, published on 4 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.3.19, 4.4.13, 4.5.6, Mastodon is vulnerable to web cache poisoning via `Rails.cache. When AUTHORIZED_FETCH is enabled, the ActivityPub endpoints for pinned posts and featured hashtags have contents that depend on the account that signed the HTTP request. However, these contents are stored in an internal cache and reused with no regards to the signing actor. As a result, an empty response generated for a blocked user account may be served to requests from legitimate non-blocked actors, or conversely, content intended for non-blocked actors may be returned to blocked actors. This issue has been patched in versions 4.3.19, 4.4.13, 4.5.6.
Weakness: CWE-524
Which versions are affected by CVE-2026-25540?
1 open source package ship an affected version, including mastodon. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mastodon Bitnami | All versions | 4.5.6 |
Products include Joinmastodon Mastodon.
How do I fix CVE-2026-25540?
Upgrade mastodon to 4.5.6 or later.
Is CVE-2026-25540 being exploited?
There is no known exploitation of CVE-2026-25540 in the wild and no public exploit code.
Other vulnerabilities in mastodon
- CVE-2023-36460 Mastodon vulnerable to arbitrary file creation through media attachments
- CVE-2022-2166 Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon
- CVE-2022-24307 Missing authorization in n/a
- CVE-2018-21018 Auth bypass in n/a
- CVE-2024-23832 Mastodon Remote user impersonation and takeover
Sources
Also known as BIT-mastodon-2026-25540, GHSA-ccpr-m53r-mfwr.