CVE-2025-62175: mastodon — Fix

Description

Mastodon is a free, open-source social network server based on ActivityPub. In versions before 4.4.6, 4.3.14, and 4.2.27, disabling or suspending a user account does not disconnect the account from the streaming API. This allows disabled or suspended accounts to continue receiving real-time updates through existing streaming connections and to establish new streaming connections, even though they cannot interact with other API endpoints. This undermines moderation actions, as administrators expect disabled or suspended accounts to be fully disconnected from the service. This issue has been patched in versions 4.4.6, 4.3.14, and 4.2.27. No known workarounds exist.

Is your site exposed to CVE-2025-62175?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness Type (CWE)

CWE-273 CWE-273

CWE-274 CWE-274

Affected Products

Vendor	Product	Versions
joinmastodon	mastodon	< 4.2.27
joinmastodon	mastodon	4.3.0 — 4.3.14
joinmastodon	mastodon	4.4.0 — 4.4.6

References

Advisories & Patches

https://github.com/mastodon/mastodon/commit/2971ac9863b91372e68ac152caf6f4dbff511d17 https://github.com/mastodon/mastodon/security/advisories/GHSA-r2fh-jr9c-9pxh

Frequently Asked Questions

What is CVE-2025-62175? +

Mastodon is a free, open-source social network server based on ActivityPub. In versions before 4.4.6, 4.3.14, and 4.2.27, disabling or suspending a user account does not disconnect the account from the streaming API. This allows disabled or suspended accounts to continue receiving real-time updates through existing streaming connections and to establish new streaming connections, even though they cannot interact with other API endpoints. This undermines moderation actions, as administrators expect disabled or suspended accounts to be fully disconnected from the service. This issue has been patched in versions 4.4.6, 4.3.14, and 4.2.27. No known workarounds exist. It has a CVSS v3.1 base score of 4.3 (MEDIUM).

How severe is CVE-2025-62175? +

CVE-2025-62175 has a CVSS v3.1 score of 4.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-62175? +

CVE-2025-62175 affects products from joinmastodon, specifically: mastodon. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-62175? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-1003

A potential vulnerability has been identified in HP Anyware Agent for Linux which might allow for authentication bypass which may …

CVE-2026-32107 8.8

xrdp is an open source RDP server. In versions through 0.10.5, the session execution component did not properly handle an …

CVE-2024-8382 8.8

Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content …

CVE-2025-27396 8.8

A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly limit the …

CVE-2026-0099 7.8

In onNullBinding of HostEmulationManager.java, there is a possible way to launch an activity from the background due to a logic …

CVE-2023-34322 7.8

For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in …

CVE-2025-62175