CVE-2025-67500
Joinmastodon Mastodon ≤ 4.2.28
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-67500 is a low-severity Observable Response Discrepancy (CWE-204) vulnerability in Joinmastodon Mastodon. Its CVSS base score is 3.7 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Account Discovery (T1087); ranked at the 12th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-6 (Authentication Feedback) and SI-11 (Error Handling) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-202338
Vulnerability Data
Mastodon is a free, open-source social network server based on ActivityPub. Versions 4.2.27 and prior, 4.3.0-beta.1 through 4.3.14, 4.4.0-beta.1 through 4.4.9, 4.5.0-beta.1 through 4.5.2 have discrepancies in error handling which allow checking whether a given status exists by sending a…
more
request with a non-English Accept-Language header. Using this behavior, an attacker who knows the identifier of a particular status they are not allowed to see can confirm whether this status exists or not. This cannot be used to learn the contents of the status or any other property besides its existence. This issue is fixed in versions 4.2.28, 4.3.15, 4.4.10 and 4.5.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V13.4.5
Mitigating Controls (NIST 800-53 r5) AI
Obscuring authentication feedback directly stops one common source of observable response discrepancies.
Error handling explicitly requires messages that avoid revealing exploitable internal information.
Information flow enforcement can block responses that would otherwise disclose internal state to unauthorized parties.
Boundary protection monitors and filters outbound responses that could leak internal state.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent introduction of inconsistent response behavior that leaks internal state.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect observable response discrepancies before deployment.
Network security controls can enforce uniform responses and suppress observable discrepancies.
Secure SDLC practices include error-handling and response standardization to avoid information disclosure.
Application security requirements typically mandate consistent, non-revealing error messages.
Secure architecture principles discourage designs that leak internal state via differing responses.
Secure coding standards explicitly require uniform error handling to prevent information leakage.