« Volver al listado

CVE-2026-25540

Estado: AnalizadaMedia (6.5)—

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.3.19, 4.4.13, 4.5.6, Mastodon is vulnerable to web cache poisoning via `Rails.cache. When AUTHORIZED_FETCH is enabled, the ActivityPub endpoints for pinned posts and featured hashtags have contents that depend on the account that signed the HTTP request. However, these contents are stored in an internal cache and reused with no regards to the signing actor. As a result, an empty response generated for a blocked user account may be served to requests from legitimate non-blocked actors, or conversely, content intended for non-blocked actors may be returned to blocked actors. This issue has been patched in versions 4.3.19, 4.4.13, 4.5.6.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Joinmastodon — Mastodon

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-25540",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-25540",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-05T18:30:03.654017Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "mastodon",
          "product": "mastodon",
          "versions": [
            {
              "status": "affected",
              "version": "< 4.3.19"
            },
            {
              "status": "affected",
              "version": "< 4.4.13"
            },
            {
              "status": "affected",
              "version": "< 4.5.6"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-04T22:16:00.233",
  "references": [
    {
      "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-ccpr-m53r-mfwr",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-524"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.3.19, 4.4.13, 4.5.6, Mastodon is vulnerable to web cache poisoning via `Rails.cache. When AUTHORIZED_FETCH is enabled, the ActivityPub endpoints for pinned posts and featured hashtags have contents that depend on the account that signed the HTTP request. However, these contents are stored in an internal cache and reused with no regards to the signing actor. As a result, an empty response generated for a blocked user account may be served to requests from legitimate non-blocked actors, or conversely, content intended for non-blocked actors may be returned to blocked actors. This issue has been patched in versions 4.3.19, 4.4.13, 4.5.6."
    },
    {
      "lang": "es",
      "value": "Mastodon es un servidor de red social gratuito, de código abierto, basado en ActivityPub. Antes de las versiones 4.3.19, 4.4.13, 4.5.6, Mastodon es vulnerable al envenenamiento de caché web a través de 'Rails.cache'. Cuando AUTHORIZED_FETCH está habilitado, los puntos finales de ActivityPub para publicaciones fijadas y hashtags destacados tienen contenidos que dependen de la cuenta que firmó la solicitud HTTP. Sin embargo, estos contenidos se almacenan en una caché interna y se reutilizan sin tener en cuenta al actor firmante. Como resultado, una respuesta vacía generada para una cuenta de usuario bloqueada puede ser servida a solicitudes de actores legítimos no bloqueados, o, a la inversa, contenido destinado a actores no bloqueados puede ser devuelto a actores bloqueados. Este problema ha sido parcheado en las versiones 4.3.19, 4.4.13, 4.5.6."
    }
  ],
  "lastModified": "2026-06-17T10:24:49.297",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7C5EDBA6-4837-43AB-AEF3-C61A974B5017",
              "versionEndExcluding": "4.3.19"
            },
            {
              "criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5A55C7B9-3FC4-4DB8-8C33-8C3435A54F63",
              "versionEndExcluding": "4.4.13",
              "versionStartIncluding": "4.4.0"
            },
            {
              "criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A3A0CD1A-0EC2-43E3-8273-D3D06A65A2D9",
              "versionEndExcluding": "4.5.6",
              "versionStartIncluding": "4.5.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}