CVE-2025-27399
📋 TL;DR
Mastodon instances with domain block visibility set to 'users' (logged-in users) inadvertently expose block reasons to unapproved users. This affects instance administrators who want to keep domain blocks private from non-approved users.
💻 Affected Systems
- Mastodon
📦 What is this software?
Mastodon by Joinmastodon
Mastodon by Joinmastodon
Mastodon by Joinmastodon
⚠️ Risk & Real-World Impact
Worst Case
Unapproved users could view sensitive domain block reasons, potentially revealing moderation strategies or internal policies to unauthorized individuals.
Likely Case
Unapproved users gain unintended visibility into domain block reasons that administrators intended to keep private from them.
If Mitigated
With proper access controls, only approved users can view domain block reasons as intended.
🎯 Exploit Status
Exploitation requires an unapproved user account and domain blocks configured with 'users' visibility.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.1.23, 4.2.16, or 4.3.4
Vendor Advisory: https://github.com/mastodon/mastodon/security/advisories/GHSA-94h4-fj37-c825
Restart Required: Yes
Instructions:
1. Backup your Mastodon instance. 2. Update to version 4.1.23, 4.2.16, or 4.3.4 depending on your current major version. 3. Restart the Mastodon services.
🔧 Temporary Workarounds
Change domain block visibility
allSet domain block visibility to 'public' or 'disabled' instead of 'users' to prevent exposure to unapproved users.
🧯 If You Can't Patch
- Change domain block visibility settings to 'public' or 'disabled' instead of 'users'
- Temporarily disable new user registrations or approval processes
🔍 How to Verify
Check if Vulnerable:
Check Mastodon version and verify if domain block visibility is set to 'users' for any blocks.Check Version:
Check Mastodon admin interface or run appropriate version check for your deployment method.Verify Fix Applied:
Confirm Mastodon version is 4.1.23, 4.2.16, or 4.3.4 or higher.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to domain block API endpoints by unapproved users
Network Indicators:
- API requests to /api/v1/instances/domain_blocks from unapproved user accounts
SIEM Query:
source="mastodon" AND (uri_path="/api/v1/instances/domain_blocks" OR endpoint="domain_blocks") AND user_status="unapproved"🔗 References
- https://github.com/mastodon/mastodon/blob/93f0427b8a84faf68d5d02cdf9a26f98fae16f2b/app/controllers/api/v1/instances/domain_blocks_controller.rb#L33-L35
- https://github.com/mastodon/mastodon/blob/93f0427b8a84faf68d5d02cdf9a26f98fae16f2b/app/controllers/api/v1/instances/domain_blocks_controller.rb#L49-L51
- https://github.com/mastodon/mastodon/commit/6b519cfefa93a923b19d0f20c292c7185f8fd5f5
- https://github.com/mastodon/mastodon/security/advisories/GHSA-94h4-fj37-c825
