CVE-2025-62176

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-62176", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-10-07T16:12:03.426Z", "datePublished": "2025-10-13T21:04:53.206Z", "dateUpdated": "2025-10-14T13:53:19.170Z"}, "containers": {"cna": {"title": "Mastadon streaming server allows OAuth clients without the `read` scope to subscribe to public channels", "problemTypes": [{"descriptions": [{"cweId": "CWE-280", "lang": "en", "description": "CWE-280: Improper Handling of Insufficient Permissions or Privileges", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/mastodon/mastodon/security/advisories/GHSA-7gwh-mw97-qjgp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-7gwh-mw97-qjgp"}, {"name": "https://github.com/mastodon/mastodon/commit/7e98fa9b476fdaed235519f1d527eb956004ba0c", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/commit/7e98fa9b476fdaed235519f1d527eb956004ba0c"}], "affected": [{"vendor": "mastodon", "product": "mastodon", "versions": [{"version": ">= 4.4.0-beta.1, < 4.4.6", "status": "affected"}, {"version": ">= 4.3.0-beta.1, < 4.3.14", "status": "affected"}, {"version": "< 4.2.27", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-13T21:04:53.206Z"}, "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, the streaming server accepts serving events for public timelines to clients using any valid authentication token, even if those tokens lack the read:statuses scope. This allows OAuth clients without the read scope to subscribe to public channels and receive public timeline events. The impact is limited, as this only affects new public posts published on the public timelines and requires an otherwise valid token, but this may lead to unexpected access to public posts in a limited-federation setting. This issue has been patched in versions 4.4.6, 4.3.14, and 4.2.27. No known workarounds exist."}], "source": {"advisory": "GHSA-7gwh-mw97-qjgp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-14T13:52:45.626727Z", "id": "CVE-2025-62176", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T13:53:19.170Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Mastadon streaming server allows OAuth clients without the `read` scope to subscribe to public channels", "source": {"advisory": "GHSA-7gwh-mw97-qjgp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "mastodon", "product": "mastodon", "versions": [{"status": "affected", "version": ">= 4.4.0-beta.1, < 4.4.6"}, {"status": "affected", "version": ">= 4.3.0-beta.1, < 4.3.14"}, {"status": "affected", "version": "< 4.2.27"}]}], "references": [{"url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-7gwh-mw97-qjgp", "name": "https://github.com/mastodon/mastodon/security/advisories/GHSA-7gwh-mw97-qjgp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/mastodon/mastodon/commit/7e98fa9b476fdaed235519f1d527eb956004ba0c", "name": "https://github.com/mastodon/mastodon/commit/7e98fa9b476fdaed235519f1d527eb956004ba0c", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, the streaming server accepts serving events for public timelines to clients using any valid authentication token, even if those tokens lack the read:statuses scope. This allows OAuth clients without the read scope to subscribe to public channels and receive public timeline events. The impact is limited, as this only affects new public posts published on the public timelines and requires an otherwise valid token, but this may lead to unexpected access to public posts in a limited-federation setting. This issue has been patched in versions 4.4.6, 4.3.14, and 4.2.27. No known workarounds exist."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-280", "description": "CWE-280: Improper Handling of Insufficient Permissions or Privileges"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-13T21:04:53.206Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-62176", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-14T13:52:45.626727Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2025-10-14T13:53:03.454Z"}}]}, "cveMetadata": {"cveId": "CVE-2025-62176", "state": "PUBLISHED", "dateUpdated": "2025-10-13T21:04:53.206Z", "dateReserved": "2025-10-07T16:12:03.426Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-13T21:04:53.206Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "mastodon", "vendor": "mastodon", "versions": [{"status": "affected", "version": ">= 4.4.0-beta.1, < 4.4.6"}, {"status": "affected", "version": ">= 4.3.0-beta.1, < 4.3.14"}, {"status": "affected", "version": "< 4.2.27"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*", "matchCriteriaId": "5AFD1281-DEE1-421D-B62B-8D9727428763", "versionEndExcluding": "4.2.27", "vulnerable": true}, {"criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*", "matchCriteriaId": "CE867F92-59FF-4768-974B-D4BDF71B1FFA", "versionEndExcluding": "4.3.14", "versionStartIncluding": "4.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*", "matchCriteriaId": "6F6F2EB3-8C86-417E-8D7B-499438B63D61", "versionEndExcluding": "4.4.6", "versionStartIncluding": "4.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, the streaming server accepts serving events for public timelines to clients using any valid authentication token, even if those tokens lack the read:statuses scope. This allows OAuth clients without the read scope to subscribe to public channels and receive public timeline events. The impact is limited, as this only affects new public posts published on the public timelines and requires an otherwise valid token, but this may lead to unexpected access to public posts in a limited-federation setting. This issue has been patched in versions 4.4.6, 4.3.14, and 4.2.27. No known workarounds exist."}, {"lang": "es", "value": "Mastodon es un servidor de red social gratuito y de c\u00f3digo abierto basado en ActivityPub. En Mastodon antes de 4.4.6, 4.3.14 y 4.2.27, el servidor de streaming acepta servir eventos para l\u00edneas de tiempo p\u00fablicas a clientes usando cualquier token de autenticaci\u00f3n v\u00e1lido, incluso si esos tokens carecen del alcance read:statuses. Esto permite a los clientes OAuth sin el alcance de lectura suscribirse a canales p\u00fablicos y recibir eventos de l\u00edneas de tiempo p\u00fablicas. El impacto es limitado, ya que esto solo afecta a las nuevas publicaciones p\u00fablicas en las l\u00edneas de tiempo p\u00fablicas y requiere un token v\u00e1lido de otra manera, pero esto puede llevar a un acceso inesperado a publicaciones p\u00fablicas en un entorno de federaci\u00f3n limitada. Este problema ha sido parcheado en las versiones 4.4.6, 4.3.14 y 4.2.27. No existen soluciones alternativas conocidas."}], "id": "CVE-2025-62176", "lastModified": "2026-10-19T16:10:00.260", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62176", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-14T13:52:45.626727Z", "version": "2.0.3"}}]}, "published": "2025-10-13T21:15:35.093", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/mastodon/mastodon/commit/7e98fa9b476fdaed235519f1d527eb956004ba0c"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-7gwh-mw97-qjgp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-280"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-10-21T13:10:46.256410+00:00", "updated": "2025-10-21T13:10:46.256449+00:00", "vendors": ["joinmastodon", "joinmastodon$PRODUCT$mastodon"]}