Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting specific activities, an attacker can extend the audience of a post they do not own to other Mastodon users on a target server, thus gaining access to the contents of a post not intended for them. Versions 4.1.18 and 4.2.10 contain a patch for this issue.

According to its self-reported version number, the Mastodon application running on the remote host is prior to 4.1.18 or 4.2.x prior to 4.2.10. It is, therefore, affected by multiples vulnerabilities :

- An Insufficient permission checking on multiple API endpoints - An Improper authorship check on audience extension for existing posts - An issue with revoked token, after a user revokes an application's access token, the application can still receive the user's private mentions, notifications, etc via existing connection(s) to the streaming API.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
114473	Mastodon 4.2.x < 4.2.10 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
114472	Mastodon < 4.1.18 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high

Detections

Analytics

CVE-2024-37903

high

Tenable Plugins

high

high