CVE-2025-62176

{
  "id": "CVE-2025-62176",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-13T21:15:35.093",
  "lastModified": "2026-10-19T16:10:00.260",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, the streaming server accepts serving events for public timelines to clients using any valid authentication token, even if those tokens lack the read:statuses scope. This allows OAuth clients without the read scope to subscribe to public channels and receive public timeline events. The impact is limited, as this only affects new public posts published on the public timelines and requires an otherwise valid token, but this may lead to unexpected access to public posts in a limited-federation setting. This issue has been patched in versions 4.4.6, 4.3.14, and 4.2.27. No known workarounds exist."
    },
    {
      "lang": "es",
      "value": "Mastodon es un servidor de red social gratuito y de código abierto basado en ActivityPub. En Mastodon antes de 4.4.6, 4.3.14 y 4.2.27, el servidor de streaming acepta servir eventos para líneas de tiempo públicas a clientes usando cualquier token de autenticación válido, incluso si esos tokens carecen del alcance read:statuses. Esto permite a los clientes OAuth sin el alcance de lectura suscribirse a canales públicos y recibir eventos de líneas de tiempo públicas. El impacto es limitado, ya que esto solo afecta a las nuevas publicaciones públicas en las líneas de tiempo públicas y requiere un token válido de otra manera, pero esto puede llevar a un acceso inesperado a publicaciones públicas en un entorno de federación limitada. Este problema ha sido parcheado en las versiones 4.4.6, 4.3.14 y 4.2.27. No existen soluciones alternativas conocidas."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "mastodon",
          "product": "mastodon",
          "versions": [
            {
              "version": ">= 4.4.0-beta.1, < 4.4.6",
              "status": "affected"
            },
            {
              "version": ">= 4.3.0-beta.1, < 4.3.14",
              "status": "affected"
            },
            {
              "version": "< 4.2.27",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-14T13:52:45.626727Z",
          "id": "CVE-2025-62176",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-280"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "4.2.27",
              "matchCriteriaId": "5AFD1281-DEE1-421D-B62B-8D9727428763"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.3.0",
              "versionEndExcluding": "4.3.14",
              "matchCriteriaId": "CE867F92-59FF-4768-974B-D4BDF71B1FFA"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.4.0",
              "versionEndExcluding": "4.4.6",
              "matchCriteriaId": "6F6F2EB3-8C86-417E-8D7B-499438B63D61"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/mastodon/mastodon/commit/7e98fa9b476fdaed235519f1d527eb956004ba0c",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-7gwh-mw97-qjgp",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}