{"id":"CVE-2025-27399","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-27399","generatedAt":"2026-10-28T01:13:38.977Z","title":"Mastodon is a self-hosted, federated microblogging platform.","description":"Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/reasons is set to \"users\" (localized English string: \"To logged-in users\"), users that are not yet approved can view the block reasons. Instance admins that do not want their domain blocks to be public are impacted. Versions 4.1.23, 4.2.16, and 4.3.4 fix the issue.","published":"2025-02-27T18:15:30.000Z","lastModified":"2026-06-17T09:03:31.000Z","status":"Analyzed","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"cwe":["CWE-200","CWE-285"],"affected":["joinmastodon/mastodon"],"epss":{"score":0.00357,"percentile":0.29155,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.36%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/mastodon/mastodon/blob/93f0427b8a84faf68d5d02cdf9a26f98fae16f2b/app/controllers/api/v1/instances/domain_blocks_controller.rb#L33-L35","tags":["Product"],"source":"security-advisories@github.com"},{"url":"https://github.com/mastodon/mastodon/blob/93f0427b8a84faf68d5d02cdf9a26f98fae16f2b/app/controllers/api/v1/instances/domain_blocks_controller.rb#L49-L51","tags":["Product"],"source":"security-advisories@github.com"},{"url":"https://github.com/mastodon/mastodon/commit/6b519cfefa93a923b19d0f20c292c7185f8fd5f5","tags":["Patch"],"source":"security-advisories@github.com"},{"url":"https://github.com/mastodon/mastodon/security/advisories/GHSA-94h4-fj37-c825","tags":["Vendor Advisory"],"source":"security-advisories@github.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-27399","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}